Tor Browser: all versions and old releases

Tor Browser 15.0.26 is now available from the Tor Browser download page and also from our distribution directory.
This version blocks compromised intermediate eMudhra certificates.
Note: the updated revocation database can take some minutes to build on first browser startup.

The full changelog since Tor Browser 15.0.25 is:
- All Platforms
- Bug tor-browser#45397: Update CA intermediates and other settings dumps
- applications
- releases

All Platforms
- Updated Tor to 0.4.9.14
- Updated NoScript to 13.6.36.1984
- Updated OpenSSL to 3.5.9
- Bug tor-browser#45377: Remove alt text from YEC 2026
- Bug tor-browser#45382: Backport Security Fixes from 158

Build System
All Platforms
- Bug tor-browser-build#41885: Update changelogs as a last step in relprep.py
Windows
- Bug tor-browser-build#41890: Update sign-exe wrapper to use new Windows signing cert

Windows Package Signature Issue
The DigiCert EV code‑signing certificate we use to sign Windows installation packages expired on September 1st and is being renewed. This delay caused Windows users installing Tor Browser 15.0.21 and 15.0.22 from scratch to see “bad signature” warnings. As a temporary workaround, Windows users can install Tor Browser 15.0.20 (the latest correctly signed version) and rely on automatic updates (signed with a different key) to reach the current version. Users who prefer to download the latest version directly, ignoring the certificate expiration warning, can do so from the Tor Project distribution directory.

New PGP subkey
This release is signed using a new subkey. If you previously used GPG to verify Tor Browser downloads, you may need to refresh the Tor Browser signing key (0xEF6E286DDA85EA2A4BA7DE684E2C6E8793298290) in your local keyring. See the signature verification page for details.

Send us your feedback
If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog
All Platforms
- Updated NoScript to 13.6.35.1984
- Updated Tor to 0.4.9.13
- Bug tor-browser#45358: Rebase Tor Browser stable onto 140.17.0esr
- Bug tor-browser#45366: Backport Security Fixes from Firefox 157
- Bug tor-browser#45368: Account for onion aliases in NoScript site parsing
- Bug tor-browser#45371: Hook CharacterData/Range insertion sinks for content patches propagation
Windows + macOS + Linux
- Updated Firefox to 140.17.0esr
- Bug tor-browser#45218: Implement YEC 2026 Takeover for Desktop Stable
Linux
- Bug tor-browser#44996: Change the 32‑bit linux message to the expired version for the final 15.0 release
Android
- Updated GeckoView to 140.17.0esr
- Bug tor-browser#45217: Implement YEC 2026 Takeover for Android Stable
Build System
All Platforms
- Bug tor-browser-build#41847: Sign all releases using new gpg subkey
macOS
- Bug tor-browser-build#41883: Fix sha256sum definition in projects/hfsplus-tools/config

This version includes important security updates to Firefox.

Windows Package Signature Issue
The DigiCert EV code‑signing certificate we use to sign Windows installation packages expired on September 1st and we are currently in the process to renew it. This process is delayed and not yet complete. This has caused Windows users trying to install Tor Browser 15.0.21 and 15.0.22 from scratch to receive “bad signature” warnings. As a temporary work‑around, for Windows only we are keeping Tor Browser 15.0.20 (the latest correctly signed version) listed on our download page, relying on automatic updates (which are signed with a different key, not involving this expired certificate) to bring Windows users to the current version. Users who prefer to download the latest version directly, ignoring the certificate expiration warning, can download it from the distribution directory.

Full changelog
- All Platforms
- Updated NoScript to 13.6.33.1984
- Bug tor-browser#45296: (H1) SharedWorker Identity Mismatch allows WebAssembly execution at Safer
- Bug tor-browser#45297: (H1) Missing setHTMLUnsafe hook leaves a permanent WebAssembly‑capable child realm at Safer
- Bug tor-browser#45299: Backport Security Fixes from Firefox 156
- Bug tor-browser#45303: Rebase Tor Browser stable onto 140.16.0esr
- Bug tor-browser-build#41875: Update relprep.py for the new versions.ini URL
- Windows + macOS + Linux
- Updated Firefox to 140.16.0esr
- Linux
- Bug tor-browser#44996: Change the 32‑bit linux message to the expired version for the final 15.0 release
- Android
- Updated GeckoView to 140.16.0esr
- Build System
- All Platforms
- Bug tor-browser-build#41871: Update downloads repository references in relprep templates

This version includes important security updates to Tor.

Full changelog
- All Platforms
- Updated Tor to 0.4.9.12
- applications
- releases

This version includes important security updates to Firefox.

All Platforms
- Updated NoScript to 13.6.32.1984
- Updated OpenSSL to 3.5.8
- Bug tor-browser#45223: Backport tor-browser#45220 - about:torconnect doesn't show when launching the browser in non-PBM
- Bug tor-browser#45253: Rebase Tor Browser stable onto 140.15.0esr
- Bug tor-browser#45259: Backport Security Fixes from Firefox 155

Windows + macOS + Linux
- Updated Firefox to 140.15.0esr
- Bug tor-browser#44996: Change the 32-bit linux message to the expired version for the final 15.0 release
- Bug tor-browser#45264: Use parent process for TorConnect redirections

Android
- Updated GeckoView to 140.15.0esr

Build System
- Windows + Linux + Android
- Updated Go to 1.25.14

Full changelog
- All Platforms
- Bug tor-browser#45204: Rebase Tor Browser stable onto 140.14.0esr
- Bug tor-browser#45219: Backport Security Fixes from Firefox 154
- Windows + macOS + Linux
- Updated Firefox to 140.14.0esr
- Android
- Updated GeckoView to 140.14.0esr
- Build System
- All Platforms
- Bug tor-browser-build#41839: Backport tor-browser-build-browser#41831: Update libevent to 2.1.13
- Bug tor-browser-build#41850: Update keyring/torbrowser.gpg for new subkey and updated expiration date of the main key
- Windows + Linux + Android
- Updated Go to 1.25.13

All Platforms
- Updated NoScript to 13.6.31.1984
- Bug tor-browser#44748: Revert Funding the Commons Implementations
- Bug tor-browser#45117: Rebase Tor Browser stable onto 140.13.0esr
- Bug tor-browser#45124: Backport Security Fixes from Firefox 153

Windows + macOS + Linux
- Updated Firefox to 140.13.0esr

Android
- Updated GeckoView to 140.13.0esr

Build System
All Platforms
- Bug tor-browser-build#41838: Update personal_access_tokens URL in tools/fetch_changelogs.py

Windows
- Bug tor-browser-build#41819: Fix windows-rs URL in projects/firefox/config

All Platforms
- Updated NoScript to 13.6.30.1984
- Bug tor-browser#45111: Cherry-pick latest firefox/esr140 commits on 140.12.0esr

Build System
- All Platforms
- Bug tor-browser-build#41821: Update gpg subkeys for boklm
- Windows + Linux + Android
- Updated Go to 1.25.12

Full changelog
- All Platforms
- Updated Tor to 0.4.9.11
- Updated NoScript to 13.6.25.1984
- Build System
- All Platforms
- Bug tor-browser-build#41821: Update gpg subkeys for boklm
- Bug tor-browser-build#41827: Update morgan's keychain with renewed key

Full changelog
- All Platforms
- Updated NoScript to 13.6.24.1984
- Updated OpenSSL to 3.5.7
- Bug tor-browser#45044: NS 13.6.19.902 DocStartInjection regressed
- Bug tor-browser#45046: Rebase Tor Browser stable onto 140.12.0esr
- Bug tor-browser#45054: Backport Security Fixes from Firefox 152
- Windows + macOS + Linux
- Updated Firefox to 140.12.0esr
- Android
- Updated GeckoView to 140.12.0esr
- Build System
- All Platforms
- Bug tor-browser-build#41802: Remove the tor daemon requirement for signing
- Windows + Linux + Android
- Updated Go to 1.25.11

This release contains important security updates to the tor daemon and fixes some censorship circumvention problems.

Changelog:
- Updated NoScript to 13.6.20.1984
- Updated Tor to 0.4.9.9
- Bug tor-browser#42436: Allow for multiple configured (front, reflector) domain fronting pairs in Moat module
- Bug tor-browser#44997: Captcha doesn't work in TB desktop
- Bug tor-browser#44886: Backport tor-browser#44361: Notify Linux i686 users that they won't receive updates anymore

All Platforms
- Bug tor-browser#44958: Backport Security Fixes from Firefox 151
Windows + macOS + Linux
- Updated Firefox to 140.11.0esr
Android
- Updated GeckoView to 140.11.0esr
Build System
All Platforms
- Bug tor-browser-build#41781: Fix clean section in rbm.local.conf.example
- Bug tor-browser-build#41798: Update the URL to versions.ini in relprep.py
Windows + Linux + Android
- Updated Go to 1.25.10

Send us your feedback
If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog since Tor Browser 15.0.12 is:
- All Platforms
- Updated tor to 0.4.9.8
- Updated NoScript to 13.6.19.1984

Changelog
All Platforms
- Updated tor to 0.4.9.7
- Bug tor-browser#44940: Rebase Tor Browser stable onto 140.10.2esr
Windows + macOS + Linux
- Updated Firefox to 140.10.2esr
- Bug tor-browser#44746: Funding the Commons Implementation (Desktop)
Android
- Updated GeckoView to 140.10.2esr
- Bug tor-browser#44747: Funding the Commons Implementation (Android)
Build System
All Platforms
- Bug tor-browser-build#41781: Fix clean section in rbm.local.conf.example

This version includes important security updates to Firefox.

Full changelog since Tor Browser 15.0.10:
- All Platforms
- Updated NoScript to 13.6.18.1984
- Bug tor-browser#44907: Rebase Tor Browser onto 140.10.1esr
- Windows + macOS + Linux
- Updated Firefox to 140.10.1esr
- Android
- Updated GeckoView to 140.10.1esr

Full changelog
All Platforms
- Updated OpenSSL to 3.5.6
- Bug tor-browser#44749: Check search engines parameter replacements
- Bug tor-browser#44852: Rebase Tor Browser stable onto 140.10.0esr
- Bug tor-browser#44859: Backport Bugzilla 1666613: Display XML error pages in the browser directionality while force LTRing the XML code itself, without the use of intl.css
- Bug tor-browser#44863: Backport Security Fixes from Firefox 150
- Bug tor-browser-build#41775: Update list of Snowflake STUN servers in default bridge line, 2026 edition
Windows + macOS + Linux
- Updated Firefox to 140.10.0esr
- Bug tor-browser#44288: New identity fails to block loading a custom home page
Android
- Updated GeckoView to 140.10.0esr
Build System
All Platforms
- Bug tor-browser-build#41767: Add jwilde to allowed signer for browser projects
Windows + Linux + Android
- Updated Go to 1.25.9

This version includes important security updates to Firefox.

Full changelog since Tor Browser 15.0.8:
- All Platforms
- Updated Tor to 0.4.9.6
- Updated NoScript to 13.6.15.1984
- Bug tor-browser#44837: Rebase Tor Browser stable onto 140.9.1esr
- Windows + macOS + Linux
- Updated Firefox to 140.9.1esr
- Android
- Updated GeckoView to 140.9.1esr
- Build System
- All Platforms
- Bug tor-browser-build#41758: Rename tools/signing/deploy-legacy to tools/signing/redeploy-update_responses-release
- Windows + macOS
- Bug tor-browser-build#41741: Create a 13.5-specific update path

All Platforms
Updated NoScript to 13.6.12.1984
Bug tor-browser#44663: NoScript behavior on “Safer” security level prevents integrity checks for dynamically loaded javascript
Bug tor-browser#44680: Properly handle subdocuments created by data: URLs
Bug tor-browser#44761: Safer Level's worker patching filters out Worker constructor options
Bug tor-browser#44771: Rebase Tor Browser stable onto 140.9.0esr
Bug tor-browser#44784: Backport Security Fixes from Firefox 149
Bug tor-browser-build#41738: Allow to specify an unsupportedURL on update responses

Windows + macOS + Linux
Updated Firefox to 140.9.0esr
Bug tor-browser#44327: ERROR: Your Tor Browser profile cannot be loaded. It may be missing or inaccessible
Bug tor-browser#44386: Firefox profiles no longer work in Tor Browser 15.0

Linux
Bug tor-browser#44657: Backport tor-browser#44394: Do not read default prefs from /etc/firefox

Android
Updated GeckoView to 140.9.0esr

Build System
Windows + Linux + Android
Updated Go to 1.25.8
Bug tor-browser#44249: Backport tor-browser-build#41580: Update Go major to 1.25.x