New Release: Tor Browser 14.5.4

[system]

by ma1 | June 24, 2025

Tor Browser 14.5.4 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 14.5.3 is:

• All Platforms
  • Updated NoScript to 13.0.8
  • Bug tor-browser#43783: Tighten up the SecurityLevel module to enforce new UX flow
  • Bug tor-browser#43784: Get confirmation from NoScript that settings are applied
  • Bug tor-browser#43885: Rebase stable onto 128.12.0esr
  • Bug tor-browser#43911: Backport security fixes from Firefox 140
• Windows + macOS + Linux
  • Updated Firefox to 128.12.0esr
  • Bug tor-browser#43782: Add new UX flow for changing security level (Desktop)
• Android
  • Updated GeckoView to 128.12.0esr
  • Bug tor-browser#43786: Add new UX flow for changing security level (Android)
• Build System
  • All Platforms
    • Bug tor-browser-build#41477: Update keyring/boklm.gpg for new subkeys (2025)
    • Bug tor-browser-build#41498: Update keyring/morgan.gpg with updated public key
  • Windows + Linux + Android
    • Updated Go to 1.23.10

---

This is a companion discussion topic for the original entry at https://blog.torproject.org/new-release-tor-browser-1454

[compis]

When I go to bug information for the new release done off the big reports give 404 error.

New Release: Tor Browser 14.5.4 | Tor Project

This also happened on the previous release.

[morgan]

Sorry about that, the confidential flag should be removed from all of them now.

[Noino]

Just seen that this release has modified the security preference UX. I need to update my Selenium Tor Browser bindings to match the new behavior, as it currently uses the SecurityLevel.sys.mjs API to change the security level on the fly. Having read through issue 43783 it looks like this may still be possible (via the browser.security_level.security_slider config setting?) however, the link in point 3. of the above GitLab issue which is described as a link to the API which avoids user prompts is broken. Can someone please confirm whether or not it is still possible to change the security level mid-session and point me at the API docs? I see that changing the above config setting itself now results in a prompt - is there a way to avoid that? Many thanks.