New Release: Tor Browser 15.0.10

[system]

by ma1 | April 21, 2026

Tor Browser 15.0.10 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox, including a fix to the cross-origin correlation issue explained here.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.9 is:

• All Platforms
  • Updated OpenSSL to 3.5.6
  • Bug tor-browser#44749: Check search engines parameter replacements
  • Bug tor-browser#44852: Rebase Tor Browser stable onto 140.10.0esr
  • Bug tor-browser#44859: Backport Bugzilla 1666613: Display XML error pages in the browser directionality while force LTRing the XML code itself, without the use of intl.css
  • Bug tor-browser#44863: Backport Security Fixes from Firefox 150
  • Bug tor-browser-build#41775: Update list of Snowflake STUN servers in default bridge line, 2026 edition
• Windows + macOS + Linux
  • Updated Firefox to 140.10.0esr
  • Bug tor-browser#44288: New identity fails to block loading a custom home page
• Android
  • Updated GeckoView to 140.10.0esr
• Build System
  • All Platforms
    • Bug tor-browser-build#41767: Add jwilde to allowed signer for browser projects
  • Windows + Linux + Android
    • Updated Go to 1.25.9

---

This is a companion discussion topic for the original entry at https://blog.torproject.org/new-release-tor-browser-15010

[atari]

Is CVE-2026-6770 fixed with this release?

Context: We Found a Stable Firefox Identifier Linking All Your Private Tor Identities

References all non-public

• Bug 2024220
• https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44863

[ebanam]

Yes. The blog post has been updated to reflect that:

This version includes important security updates to Firefox, including a fix to the cross-origin correlation issue explained here.

[BobbyB]

Interesting article. Seems closing FF browsers often is not a bad idea.

It is strange that a company which specialises in fingerprinting users, thus allowing tracking, would then disclose this information to Mozilla and Tor. I wonder if any of their clients will be pissed off. What a perfect way to track people and they grass out. Then FF browsers don’t exactly dominate the market. I wonder if they would disclose a similar situation for chrome based browsers.

In any case kudos.

[ep0tm3s]

This version of the Tor Browser cannot play videos in h264 or aac audio, although 16.0a5 (or 15.0.9) can. Kubuntu 26.04 with 7.0 kernel, ffmpeg 8.0.1 installed.

Here’s the codec info on about:support on 15.0.10, I can only post 1 pic per post, but the H264 and AAC columns on 16.0a5 says both are supported: