Tor Project blog

New Release: Tor Browser 15.0.19

2026-07-21T00:00:00Z

Tor Browser 15.0.19 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.18 is:

All Platforms
- Updated NoScript to 13.6.31.1984
- Bug tor-browser#44748: Revert Funding the Commons Implementations
- Bug tor-browser#45117: Rebase Tor Browser stable onto 140.13.0esr
- Bug tor-browser#45124: Backport Security Fixes from Firefox 153
Windows + macOS + Linux
- Updated Firefox to 140.13.0esr
Android
- Updated GeckoView to 140.13.0esr
Build System
- All Platforms
  - Bug tor-browser-build#41838: Update personal_access_tokens URL in tools/fetch_changelogs.py
- Windows
  - Bug tor-browser-build#41819: Fix windows-rs URL in projects/firefox/config

New Release: Tor Browser 15.0.18

2026-07-14T00:00:00Z

Tor Browser 15.0.18 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.17 is:

All Platforms
- Updated NoScript to 13.6.30.1984
- Bug tor-browser#45111: Cherry-pick latest firefox/esr140 commits on 140.12.0esr
Build System
- All Platforms
  - Bug tor-browser-build#41821: Update gpg subkeys for boklm
- Windows + Linux + Android
  - Updated Go to 1.25.12

New Alpha Release: Tor Browser 16.0a8

2026-07-02T00:00:00Z

Tor Browser 16.0a8 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

⚠️ Reminder: The Tor Browser Alpha release-channel is for testing only. As such, Tor Browser Alpha is not intended for general use because it is more likely to include bugs affecting usability, security, and privacy.

Moreover, Tor Browser Alphas are now based on Firefox's betas. Please read more about this important change in the Future of Tor Browser Alpha blog post.

If you are an at-risk user, require strong anonymity, or just want a reliably-working browser, please stick with the stable release channel.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 16.0a7 is:

All Platforms
- Updated NoScript to 13.6.25.90301984
- Updated Tor to 0.4.9.11
- Updated OpenSSL to 3.5.7
- Bug tor-browser#44857: Drop browser.display.use_system_colors from our preference list
- Bug tor-browser#44896: Review Mozilla 2030929: Remove unused pref privacy.partition.network_state
- Bug tor-browser#45018: resistfingerprinting not available in appearance.mjs in 152
- Bug tor-browser#45019: ReportBrokenSite startup error in 152
- Bug tor-browser#45047: Cross-site oracle via worklet rejection error in Safer Mode
- Bug tor-browser#45072: Disable XSLT already for 16.0
Windows + macOS + Linux
- Updated Firefox to 152.0a1
- Bug tor-browser#44528: Make sure desktop IP Protection is disabled on desktop
- Bug tor-browser#44795: Revert BB 27604 patch as not needed anymore
- Bug tor-browser#44844: Use new urlbar CSS variables
- Bug tor-browser#44888: Use --button-opacity-disabled for disabled styling.
- Bug tor-browser#44955: Use context-fill for about-wordmark.svg
- Bug tor-browser#44956: Switch colours in letterboxing setting icons to match the tab-alignment icons
- Bug tor-browser#45016: Several errors about EngineProcess.sys.mjs in 152
- Bug tor-browser#45017: Wrong letterboxing background in 152
- Bug tor-browser#45037: Potential runtime errors in the search service when changing JS status
- Bug tor-browser#45043: Re-add missing changes to settings after 151/152 rebase
- Bug tor-browser#45083: Error in about:preferences due to ipprotection missing
macOS
- Bug tor-browser#44728: Bundled fonts are broken on macOS when the GPU process is enabled
Linux
- Bug @ libfontconfig.so.1#45048: Backport Bugzilla 2041887: Crash in after users upgraded to fontconfig 2.18.0 [tor-browser]
Android
- Updated GeckoView to 152.0a1
- Bug tor-browser#43856: Fix onBackPressed() deprecation
- Bug tor-browser#44091: Add frequent regions to tor connection assist for android
- Bug tor-browser#44175: Remove all default browser functionality (Android)
- Bug tor-browser#44769: TBA crash screen has firefox asset as well as a "Send crash report" button
- Bug tor-browser#45052: Initialise Tor modules on android in the same order as desktop
Build System
- All Platforms
  - Bug tor-browser-build#41802: Remove the tor daemon requirement for signing
  - Bug tor-browser-build#41809: Update toolchains for Firefox 152
  - Bug tor-browser-build#41813: Disable build artifacts in make generate_gradle_dependencies_list-geckoview
  - Bug tor-browser-build#41821: Update gpg subkeys for boklm
  - Bug tor-browser-build#41823: Add versions information to the toolchain list update
  - Bug tor-browser-build#41827: Update morgan's keychain with renewed key
- Windows + Linux + Android
  - Updated Go to 1.26.4
- Windows
  - Bug tor-browser-build#41810: Define GetAddrInfoExCancel on mingw
- Android
  - Bug tor-browser#45086: Compress omni.ja with xz on Android
  - Bug tor-browser-build#41830: Update the browser project to change omni.ja.xz

New Release: Tails 7.9.1

2026-07-01T00:00:00Z

Changes and updates

Update Tor Browser to 15.0.17.
Update the Tor client to 0.4.9.11.
Update the Linux kernel to 6.12.94, which fixes CVE-2026-43503 (DirtyClone) and CVE-2026-46331 (PACKET_EDIT_MEME), vulnerabilities that could allow an application in Tails to gain administration privileges.

For example, if an attacker was able to exploit other unknown security vulnerabilities in an application included in Tails, they might then use CVE-2026-46331 to take full control of your Tails and deanonymize you.

This attack is unlikely, but could be performed by a strong attacker, such as a government or a hacking firm. We are not aware of this vulnerability being used in practice until now.

Fixed problems

For more details, read our changelog.

Get Tails 7.9.1

To upgrade your Tails USB stick and keep your Persistent Storage

Automatic upgrades are available from Tails 7.0 or later to 7.9.1.
If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.9.1 on a new USB stick

Follow our installation instructions.

The Persistent Storage on the USB stick will be lost if you install instead of upgrading.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.9.1 directly:

Support and feedback

For support and feedback, visit the Support section on the Tails website.

Arti 2.5.0 released: Stable Counter Galois Onion

2026-06-30T00:00:00Z

Arti is our ongoing project to create a next-generation Tor implementation in Rust. We're happy to announce the latest release, Arti 2.5.0.

This release marks Counter Galois Onion as a stable feature and includes it in full feature builds. Likewise, Congestion Control is now enabled in default builds of Arti, increasing the overall speed without any further configuration.

Unfortunately, this release also comes with the disclosure of two medium-severity DoS security issues, TROVE-2026-024 as well as TROVE-2026-027, whose fixes are of course included within the release.

Additionally, this release continues our ongoing development towards using Arti as a relay and as a directory authority.

Another noteworthy change is that we've increased our minimum supported Rust version to Rust 1.91, released in October 2025.

Of course, this release also contains a number of bugfixes, cleanups, and improvements throughout various parts of the code base.

For full details on what we've done, including API changes, and for information about many more minor and less-visible changes, please see the CHANGELOG.

For more information on using Arti, see our top-level README, and the documentation for the arti binary.

Thanks to everybody who's contributed to this release, including 5225225, Neel Chauhan, hjrgrn, moumenalaoui, pryty26.

Also, our deep thanks to our sponsors for funding the development of Arti!

New Release: Tor Browser 15.0.17

2026-06-28T00:00:00Z

Tor Browser 15.0.17 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Tor.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.16 is:

All Platforms
- Updated Tor to 0.4.9.11
- Updated NoScript to 13.6.25.1984
Build System
- All Platforms
  - Bug tor-browser-build#41821: Update gpg subkeys for boklm
  - Bug tor-browser-build#41827: Update morgan's keychain with renewed key

Sunsetting Tor 0.4.8 – Please update to 0.4.9 by September

2026-06-23T00:00:00Z

Hello Tor Community!

As you know, different teams inside the Tor Project are working on the Arti Relay project where we hope to be able to begin the upgrade of the network towards our Rust implementation of Tor in the near future. To support this work, we would like to announce that we intend to actively stop compatibility for 0.4.8 and earlier C Tor versions soon. This means that these versions will no longer work on the network at all after our target date, which is currently September 1st, 2026.

If you’re a Tor Browser user running an up-to-date version of Tor Browser, this won't impact you. If you're running an older, perhaps not-so-well-maintained, Onion Service somewhere, or you’re building an app that integrates C Tor, you may want to read along here.

Tor 0.4.8 reached End of Life on the 1st of June, and there will not be any more updates to this release series. We highly encourage people to upgrade to the Tor 0.4.9 series (or later).

Usually, we try not to break existing releases, even if they are unsupported, unless we have a pretty good reason. In this case, we have several reasons. With the work towards Arti on both the client and relay, the Network Team has identified a couple of features we would like to remove from the Tor ecosystem. Removing support for 0.4.8 will help us facilitate a smooth transition, and reduce effort associated with difficult to maintain features that provide very little value. Unfortunately, because Tor’s Directory Protocol layer works the way it does, we cannot remove these features without affecting older clients.

The most important reason is this: in 0.4.9, we have made some former fields in our directory data obsolete -- specifically, TAP onion keys and family lines. Removing these fields will let us save a great deal of client directory bandwidth for everyone. This, in turn, will make all Tor clients bootstrap a little faster, especially those on slow connections. But when we remove these fields, clients and relays running earlier versions of Tor will no longer work, since they expect the TAP onion keys to be present. Therefore, in order to deliver improved performance faster, we need to accelerate the date on which 0.4.8 will stop working.

The secondary reason for sunsetting 0.4.8: Our Arti directory authority implementation needs network integration soon, and it will be easier to write if it doesn’t support deprecated fields.

With this blog post out, we will begin reaching out to the downstreams of Tor we identified as shipping older versions and try to get them to upgrade. We appreciate community help here, too. If you identify that your favorite project that bundles Tor uses an outdated version of Tor, please reach out to them and (politely!) encourage them to upgrade. We are tracking some of this outreach in network-health/team#460. If you have a very good reason for needing a longer time with 0.4.8 support than 1 September 2026, please let us know by leaving a comment on that ticket.

Thank you!

New Release: Tails 7.9

2026-06-18T00:00:00Z

Changes and updates

Update Tor Browser to 15.0.16.
Update some firmware packages. This improves support for newer hardware: graphics, Wi-Fi, and so on.

Fixed problems

Stop notifying about outdated Secure Boot certificates in rare cases where the certificates are already up to date. (#21643)

For more details, read our changelog.

Get Tails 7.9

To upgrade your Tails USB stick and keep your Persistent Storage

Automatic upgrades are available from Tails 7.0 or later to 7.9.
If you cannot do an automatic upgrade or if Tails fails to start after an automatic upgrade, please try to do a manual upgrade.

To install Tails 7.9 on a new USB stick

Follow our installation instructions.

The Persistent Storage on the USB stick will be lost if you install instead of upgrading.

To download only

If you don't need installation or upgrade instructions, you can download Tails 7.9 directly:

Support and feedback

For support and feedback, visit the Support section on the Tails website.

New Release: Tor Browser 15.0.16

2026-06-17T00:00:00Z

Tor Browser 15.0.16 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.16 is:

All Platforms
- Updated NoScript to 13.6.24.1984
- Updated OpenSSL to 3.5.7
- Bug tor-browser#45044: NS 13.6.19.902 DocStartInjection regressed
- Bug tor-browser#45046: Rebase Tor Browser stable onto 140.12.0esr
- Bug tor-browser#45054: Backport Security Fixes from Firefox 152
Windows + macOS + Linux
- Updated Firefox to 140.12.0esr
Android
- Updated GeckoView to 140.12.0esr
Build System
- All Platforms
  - Bug tor-browser-build#41802: Remove the tor daemon requirement for signing
- Windows + Linux + Android
  - Updated Go to 1.25.11

Paskoocheh: When you need a tool to reach the tool

2026-06-10T00:00:00Z

++ This guest post is part of a spotlight series on the organizations defending the free Internet.++

Due to heavy information controls, people in Iran face significant barriers to accessing the Internet. Authorities have actively blocked numerous websites and apps, including conventional circumvention and digital security tools such as VPNs, social media platforms, and the app stores themselves. This creates a "chicken-and-egg" problem: users need a VPN to download a VPN.

Launched in 2016, Paskoocheh, Persian for "alleyway," is an open source alternative app store, community hub, and one-stop-shop for users to access information and tools to circumvent censorship, enhance their privacy, securely communicate, and express themselves freely online. Developed and maintained by ASL19, a technology and exiled media organization named after Article 19 of the Universal Declaration of Human Rights, Paskoocheh restores access and allows people to reach trusted tools through four censorship-resilient channels: the Paskoocheh website, Android App, Email bot, and Telegram bot.

Users are also able to reach our Persian-speaking support team through the Paskoocheh Helpdesk, which handles over 200 tickets daily. In addition, ASL19 translates and publishes accessible user guides, blog posts, and multimedia content to help users navigate online privacy and digital security best practices.

Paskoocheh serves as more than an alternative app store; it is also a bridge between tool developers and in-country users. Our support team relays user feedback to tool developers, helping improve tools and overall experience in Iran. We also conduct in-country testing with developers and user communities to evaluate new features and strengthen censorship-resilient technologies.

Paskoocheh's impact so far

This combination of access, user support, and education has turned Paskoocheh into a critical lifeline for users in Iran.

# of tool downloads since 2016: 17,634,852
# of community members in Iran supporting testing and localization efforts: 2,000+
# of monthly active users on web and app: ~200K

During periods of internet disruption and nationwide protests in Iran, these tools became critical communication lifelines. One longtime user wrote to us:

"I've been using this free app for several years now. It's free, unique, and unlike others, it has no equal." Reflecting on the broader digital environment in the country, they added that "in these difficult economic conditions, people are struggling just to survive, while many apps either empty people's pockets, deceive and lie to them, or serve as tools for spying and propaganda."

Messages like these highlight the importance of privacy-preserving technologies in environments where surveillance, censorship, and disinformation shape everyday life online. In moments of crisis, internet freedom tools become part of how people maintain relationships, exchange trusted information, and stay connected to the outside world. For some users, these tools also made it possible to continue reporting on events on the ground, verify information during periods of state-backed disinformation, and safely communicate evidence of abuses despite widespread surveillance and connectivity disruptions.

The future of Paskoocheh: Scaling a community-first approach to internet freedom

As internet censorship tactics evolve rapidly, internet shutdowns are becoming more frequent and more sophisticated, cutting communities off from information, communication, and one another.

What we have learned through this work is that access alone is not enough. Technology is only useful if people trust it, understand how to use it safely, and can rely on support networks when digital spaces become unstable or dangerous.

That is why our work extends beyond technical development. Alongside building secure access technologies, ASL19 invests heavily in user education, digital security guidance, and community capacity building. Every support ticket answered, training delivered, and piece of digital safety guidance shared helps people stay connected under pressure.

This human-centered approach is becoming increasingly important as authoritarian tactics evolve globally. During internet shutdowns and heightened censorship, local helper communities often become the first line of assistance for journalists, activists, students, and ordinary citizens.

With additional support, ASL19 aims to continue expanding Paskoocheh beyond its current capacity into a broader resilience ecosystem that combines technical innovation with stronger on-the-ground support systems. This includes improving access to trusted circumvention and privacy tools during shutdowns, expanding multilingual user support and educational resources, and deepening collaboration with communities operating under digital authoritarianism.

This work is not solely about technology products. At a moment when most people's understanding of the internet is shaped by the little squares in their pockets, it is important to acknowledge and support the broader ecosystems that make access possible. Civil society, independent media, and grassroots communities all play a part in helping people survive under pressure. This is why partnerships within the internet freedom ecosystem matter. Living under digital authoritarianism means that these are not abstract protections against hypothetical risks, but practical tools that make journalism, organizing, education, and communication possible in the first place.

About ASL19

Named after Article 19 of the Universal Declaration of Human Rights, ASL19 is a technology and exiled media organization working to counter digital authoritarianism. For more than a decade, we have partnered with civil society groups, journalists, researchers, activists, and internet users living under some of the world's most restrictive online environments. Guided by the belief that privacy and internet freedom are essential to safe communication, access to information, and civic participation, ASL19 develops technologies and support systems that help people navigate censorship, surveillance, internet shutdowns, and information manipulation. In countries such as Iran, Russia, and China, these tools serve as critical lifelines, enabling people to communicate securely, access information, document human rights abuses, and stay connected to the outside world.