# New Alpha Release: Tor Browser 12.5a6 (Android, Windows, macOS, Linux)
**URL:** https://forum.torproject.org/t/new-alpha-release-tor-browser-12-5a6-android-windows-macos-linux/7757
**Category:** Tor Browser Alpha Feedback
**Tags:** tor-browser
**Created:** [May 24, 2023, 9:25pm UTC](https://forum.torproject.org/t/new-alpha-release-tor-browser-12-5a6-android-windows-macos-linux/7757 "2023-05-24T21:25:30Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@system](https://forum.torproject.org/u/system)
#### Post date: [May 24, 2023, 9:25pm UTC](https://forum.torproject.org/t/new-alpha-release-tor-browser-12-5a6-android-windows-macos-linux/7757/1 "2023-05-24T21:25:30Z")
by [richard](https://blog.torproject.org/author/richard) | May 24, 2023
Tor Browser 12.5a6 is now available from the [Tor Browser download page](https://www.torproject.org/download/alpha/) and also from our [distribution directory](https://www.torproject.org/dist/torbrowser/12.5a6/).
This release updates Firefox 102.11.0esr, including bug fixes, stability improvements and important [security updates](https://www.mozilla.org/en-US/security/advisories/mfsa2023-17/). There were no Android-specific security updates to backport from the Firefox 113 release.
## Build-Signing Infrastructure Updates
We are in the process of updating our build signing infrastructure, and unfortunately are unable to ship code-signed 12.5a6 installers for Windows systems currently. Therefore we will not be providing full Window installers for this release. However, automatic build-to-build upgrades from 12.5a4 and 12.5a5 should continue to work as expected.
## Full changelog
The full changelog since [Tor Browser 12.5a5](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/main/projects/browser/Bundle-Data/Docs/ChangeLog.txt) is:
- All Platforms
- Updated Translations
- Updated Go to 11.9.9
- [Bug tor-browser-build#40860](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/40860): Improve the transition from the old fontconfig file to the new one
- [Bug tor-browser#41728](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41728): Pin bridges.torproject.org domains to Let's Encrypt's root cert public key
- [Bug tor-browser#41738](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41738): Replace the patch to disable live reload with its preference
- [Bug tor-browser#41757](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41757): Rebase Tor Browser Alpha to 102.11.0esr
- [Bug tor-browser#41763](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41763): TTP-02-003 WP1: Data URI allows JS execution despite safest security level (Low)
- [Bug tor-browser#41764](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41764): TTP-02-004 OOS: No user-activation required to download files (Low)
- [Bug tor-browser#41775](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41775): Avoid re-defining some macros in nsUpdateDriver.cpp
- Windows + macOS + Linux
- Updated Firefox to 102.11esr
- [Bug tor-browser#41607](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41607): Update "New Circuit" icon
- [Bug tor-browser#41736](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41736): Customize the default CustomizableUI toolbar using CustomizableUI.jsm
- [Bug tor-browser#41770](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41770): Keyboard navigation broken leaving the toolbar tor circuit button
- [Bug tor-browser#41777](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41777): Internally shippped manual does not adapt to RTL languages (it always align to the left)
- Windows + Linux
- [Bug tor-browser#41654](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41654): UpdateInfo jumped into Data
- Linux
- [Bug tor-browser#41732](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41732): implement linux font whitelist as defense-in-depth
- [Bug tor-browser#41776](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41776): System fonts are temporarily leaked on Linux after the browser is updated from 12.5a4 or earlier
- Android
- Updated GeckoView to 102.11esr
- Build System
- All Platforms
- [Bug tor-browser-build#33953](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/33953): Provide a way for easily updating Go dependencies of projects
- [Bug tor-browser-build#40673](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/40673): Avoid building each go module separately
- [Bug tor-browser-build#40818](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/40818): Enable wasm target for rust compiler
- [Bug tor-browser-build#40841](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/40841): Adapt signing scripts to new signing machines
- [Bug tor-browser-build#40849](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/40849): Move Go dependencies to the projects dependent on them, not as a standalone projects
- [Bug tor-browser-build#40856](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/40856): Unblock nightly builds
- Windows
- [Bug tor-browser-build#40846](https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/40846): Temporarily disable Windows signing
* * *
This is a companion discussion topic for the original entry at [https://blog.torproject.org/new-alpha-release-tor-browser-125a6/](https://blog.torproject.org/new-alpha-release-tor-browser-125a6/)
---
### Author:  [@Screen](https://forum.torproject.org/u/Screen)
#### Post date: [May 27, 2023, 6:40am UTC](https://forum.torproject.org/t/new-alpha-release-tor-browser-12-5a6-android-windows-macos-linux/7757/2 "2023-05-27T06:40:36Z")
> [@system](#):
>
> TTP-02-003 WP1: Data URI allows JS execution despite safest security level (Low)
Could we please get further details on this? Clicking the link gives 404. If low is in relation to level of danger then shouldn’t it actually be considered high since it allows unique fingerprinting via JavaScript. Thanks.
---
### Author:  [@donuts](https://forum.torproject.org/u/donuts)
#### Post date: [June 9, 2023, 8:44pm UTC](https://forum.torproject.org/t/new-alpha-release-tor-browser-12-5a6-android-windows-macos-linux/7757/3 "2023-06-09T20:44:59Z")
@Screen We’ve just set the ticket’s visibility to **public** , if you’d like to give the link another go!
> **[TTP-02-003 WP1: Data URI allows JS execution despite safest security level...](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/41763)**
>
> Description The Tor Browser incorporates a feature that makes it possible for users to adjust the security level of the...
---
### Author:  [@Screen](https://forum.torproject.org/u/Screen)
#### Post date: [June 10, 2023, 11:15am UTC](https://forum.torproject.org/t/new-alpha-release-tor-browser-12-5a6-android-windows-macos-linux/7757/4 "2023-06-10T11:15:15Z")
Thanks, is there any way to know if this exploit has been used against me and could I tell if a page uses this vulnerability by using ‘view-source:’ in the URL bar?
---
### Author:  [@donuts](https://forum.torproject.org/u/donuts)
#### Post date: [June 10, 2023, 2:20pm UTC](https://forum.torproject.org/t/new-alpha-release-tor-browser-12-5a6-android-windows-macos-linux/7757/5 "2023-06-10T14:20:00Z")
I suspect @ma1 might be able to help you here 🙂
---
### Author:  [@ma1](https://forum.torproject.org/u/ma1)
#### Post date: [June 10, 2023, 3:45pm UTC](https://forum.torproject.org/t/new-alpha-release-tor-browser-12-5a6-android-windows-macos-linux/7757/6 "2023-06-10T15:45:10Z")
Unless you manually pasted data: URIs in the navigation bar or you’ve got one bookmarked and opened the bookmark, there’s no way this could be used against you (just clicking a link from a web page didn’t work).
In other words, quite a bit of social engineering was required and that’s why the security auditors rated it low.
---
### Author:  [@Screen](https://forum.torproject.org/u/Screen)
#### Post date: [June 10, 2023, 4:16pm UTC](https://forum.torproject.org/t/new-alpha-release-tor-browser-12-5a6-android-windows-macos-linux/7757/7 "2023-06-10T16:16:39Z")
That is reassuring to know, many thanks