# Tor browser as possible attack vector - review/help needed

**URL:** https://forum.torproject.org/t/tor-browser-as-possible-attack-vector-review-help-needed/21781
**Category:** Tor Browser Desktop
**Tags:** security, linux, tor-browser
**Created:** [June 25, 2026, 11:42am UTC](https://forum.torproject.org/t/tor-browser-as-possible-attack-vector-review-help-needed/21781 "2026-06-25T11:42:46Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![trelip](https://forum.torproject.org/letter_avatar_proxy/v4/letter/t/e95f7d/32.png) [@trelip](https://forum.torproject.org/u/trelip)
#### Post date: [June 25, 2026, 11:42am UTC](https://forum.torproject.org/t/tor-browser-as-possible-attack-vector-review-help-needed/21781/1 "2026-06-25T11:42:46Z")

</div>

Hi. My friend is in a kind of stalking or targeted spying situation. Malicious party somehow obtained real-time info about his actions on a desktop. His browsing habits and traffic capture he did before disconnecting PC make tor browser a main candidate for both an initial attack vector and data exfiltration path.  
OS - Fedora 43 KDE, wayland 1.24.0-1  
Tor browser 15.0.13 x86\_64

I ask for help:

1. How feasible is such an attack? How much effort it would require?
2. Do these segfault logs tell anything about attempted malicious actions?  
[100 tor browser - JustPaste.it](https://justpaste.it/f4vgx)  
[102 tor browser - JustPaste.it](https://justpaste.it/fe403)  
[https://justpaste.it/cn9en](https://justpaste.it/cn9en)  
[108 tor browser - JustPaste.it](https://justpaste.it/3uqf6)  
[110 tor browser - JustPaste.it](https://justpaste.it/em9m4)
3. Can there be any evidence in the OS logs in case of using browser exploit to access display server data?
4. What ways to prevent such attacks? Browser isolation in a separate VM?