Reading a changelog as a list of decisions#
Tor Browser 15.0.24 was released on September 29, 2026, and its release post is brief. It has two paragraphs on a signing issue, one on a new key, and a changelog of about a dozen lines, most of which look like this.
Bug tor-browser#45371: Hook CharacterData/Range insertion sinks for content patches propagation
Most people just glance at the version number, and that’s perfectly fine. Automatic updates exist so you don’t have to read further. But a changelog is more interesting than it looks. Each line in it is a decision someone made. Something was noticed, judged important enough to fix, tested, and then released to millions of users. Read it that way, and a maintenance release tells you a lot about what the people building Tor Browser are worried about, what they’re preparing for, and what they need from you.
This post goes through the 15.0.24 changelog one line at a time, grouped by what each change is for. Some entries are security fixes. Others are minor corrections that don’t affect most people but matter a great deal to the few who are affected. Some are about trust, meaning how you can be sure the browser you downloaded is the genuine one. And a few are really about people, from fundraising to the end of support for older computers.
If you just want to know whether you need to do anything, the short answer is this. If Tor Browser updates itself, restart it and check you’re on 15.0.24. If you’re installing it for the first time on Windows, read the section on signing before you begin. And for the wider picture of September’s Tor security releases, covering Tails, relays and mobile apps, see Tor’s September 2026 Security Fixes: What to Update.
The security lines#
Five changelog entries are about keeping you safe from known bugs. Here they are, in plain terms.
| Changelog line | What it means | Platforms |
|---|---|---|
| Updated Firefox to 140.17.0esr | The browser engine moves to Mozilla’s latest security release of its long-term version | Windows, macOS, Linux |
| Updated GeckoView to 140.17.0esr | The same engine update, in its Android form | Android |
| Rebase Tor Browser stable onto 140.17.0esr | Tor Browser’s own changes are reapplied on top of that new engine | All |
| Backport Security Fixes from Firefox 157 | Fixes from the newest regular Firefox are pulled in where they apply | All |
| Updated Tor to 0.4.9.13 | The Tor software inside the browser gets September’s emergency fixes | All |
The engine update#
Tor Browser is built on Firefox ESR, the Extended Support Release that Mozilla provides for organisations that want fewer feature changes and a steady supply of security fixes. That’s a deliberate choice. A stable base means the Tor Project’s privacy changes, which touch hundreds of places in the code, don’t have to be rebuilt every four weeks for a new set of features.
On September 29, Mozilla released security fixes for Firefox and its ESR versions. Canada’s Cyber Centre described the affected versions as Firefox before 157 and Firefox ESR before 140.17, along with two other ESR branches. Tor Browser 15.0.24 was released the same day with ESR 140.17, so the gap between Mozilla publishing those fixes and Tor Browser users being protected was almost zero. That timing is no coincidence. Tor Browser’s release schedule follows Mozilla’s, so that browser security fixes reach Tor users as quickly as they reach Firefox users. Mozilla sets out the details of each fix in its security advisories.
“Rebase” is the developers’ word for taking Tor Browser’s own changes and applying them again on top of the new Firefox code. It’s routine, but it’s also where much of the testing happens, because every privacy patch has to still fit and still work.
The backports#
The line about backporting fixes from Firefox 157 is the more interesting one. Mozilla fixes some bugs in its regular, fast-moving Firefox without always carrying every fix back to the ESR version. Tor Browser’s developers review what changed in the newest Firefox and pull in fixes that matter for their users, even when ESR hasn’t taken them. Tor Browser’s users are more likely than most to be targeted, so waiting for ESR to catch up isn’t good enough.
That’s also why browser bugs, rather than flaws in the Tor network itself, have historically been the main way people attack Tor users. The browser is a large program that runs code from every site you visit, so keeping it up to date is essential, and raising the security level adds protection when you visit sites you don’t trust. Our guide to Tor Browser Security Levels explains what each level switches off.
The Tor update#
Tor Browser carries its own copy of Tor, and 15.0.24 brings it to 0.4.9.13, released on September 23 with ten numbered security fixes for clients, relays and onion services. The previous browser release, 15.0.23, came out on September 15 and didn’t include them. For what 0.4.9.13 fixes, and how it reaches Tails, Linux packages and mobile apps, see Tor’s September 2026 Security Fixes.
The NoScript update#
NoScript moves to version 13.6.35.1984. It’s the extension that does much of the work behind Tor Browser’s security levels, deciding which scripts, fonts and media are allowed to run. The “.1984” suffix marks the version built for Tor Browser, as opposed to the one ordinary Firefox users install. You won’t notice any difference, but the security levels rely on it working properly, which is why it’s updated along with everything else.
The small lines that matter to someone#
Two changelog entries are fixes in Tor Browser’s own code, not inherited from Firefox. They look obscure, and for most people they are. But each one is there because something didn’t work as it should have, for someone.
“Account for onion aliases in NoScript site parsing”#
This one concerns a feature most Tor users have never heard of. Onion addresses are 56 random-looking characters, which makes them hard to remember and easy to fake, as we explain in What Is an Onion Service? Since Tor Browser 9.5 in 2020, the desktop browser has supported a small set of short, readable names for one particular kind of site, newsroom SecureDrop services.
According to SecureDrop’s documentation, these onion names follow the pattern organisation.securedrop.tor.onion. Tor Browser converts them into the full onion address using a signed list that the Freedom of the Press Foundation maintains. The list updates automatically, and no information is sent to anyone else when you use a name. Only newsrooms in the SecureDrop Directory can get one, and the feature only works in desktop Tor Browser, not on Android or in any other browser.
The Tor Project calls the underlying mechanism onion aliases. The 15.0.24 fix concerns how NoScript, which applies the browser’s per-site security rules, works out which site it’s dealing with when you visit one of these names. An alias and the full address are the same site, and the browser’s security decisions should treat them that way. The issue page wasn’t publicly accessible when we checked, so we can’t say exactly what went wrong before, but the direction of the fix is clear.
Why does a niche feature get a fix in a maintenance release? Because of who uses it. Someone typing a SecureDrop onion name is very often a source contacting a journalist, and SecureDrop strongly recommends doing that in desktop Tor Browser at its strictest settings. If the security level behaved differently on an alias than on the full address, that’s exactly the person you’d least want it to fail for. We cover newsroom onion sites and SecureDrop in News Onion Sites: BBC, DW, The Guardian and SecureDrop.
Onion names for everyone else don’t exist yet. On the Tor Project’s own forum, the SecureDrop names have been described as a proof of concept, and readable names for the wider onion network remain an open question, as we explain in How to Verify an Onion Address Is Official. Until that changes, any site offering a short, friendly onion name outside SecureDrop should make you suspicious.
“Hook CharacterData/Range insertion sinks for content patches propagation”#
This is the line quoted at the top of this post, and it’s the most technical one in the changelog. CharacterData and Range are standard parts of how web pages insert and change text after they’ve loaded. Tor Browser makes some adjustments of its own to page content, and this change makes sure those adjustments still apply when a page adds text through these particular routes, not just through the more usual ones.
As with the onion alias fix, the issue page wasn’t publicly accessible, so that’s as far as we can responsibly go. There’s nothing for you to do. It’s the kind of fix that happens when a developer spots a path the browser’s protections didn’t cover, and closes it before it becomes a real problem. Maintenance releases are full of these, and that’s a good sign. A browser where nobody is finding gaps is usually a browser where nobody is looking.
The lines about trust#
The most important part of this release isn’t in the changelog at all. It’s the two notes above it, about signing. Together with one build fix, they deal with a question every Tor user should care about. How can you tell that the Tor Browser you’re running is the genuine one?
There are three separate layers of signing involved, and it helps to keep them apart.
| Layer | Who checks it | What it proves | Status in September 2026 |
|---|---|---|---|
| Windows code signing | Windows itself, when you run the installer | The installer was signed by the Tor Project’s certificate | Certificate expired September 1, renewal delayed |
| PGP signature | You, if you verify the download | The file matches what the Tor Project published | Working, with a new signing subkey from this release |
| Update signing | Tor Browser, automatically | An update came from the Tor Project before it’s installed | Working, uses a separate key |
The Windows certificate problem#
The Tor Project signs its Windows installers with a DigiCert EV code-signing certificate, which Windows checks whenever an installer runs. That certificate expired on September 1, and its renewal was delayed. As a result, people installing Tor Browser 15.0.21 and 15.0.22 on Windows for the first time saw “bad signature” warnings.
The Tor Project’s workaround is practical. For Windows only, the download page keeps offering Tor Browser 15.0.20, the last correctly signed version. Install that, and the browser’s automatic updates, which are signed with a different key that doesn’t rely on the expired certificate, take you up to 15.0.24. If you’d rather install 15.0.24 directly and accept the certificate warning, the Tor Project points to its distribution directory, which is also available over onion, as listed in Tor Project’s Official Onion Sites.
For people who already use Tor Browser on Windows, this makes no difference. Your updates keep arriving and installing as normal. It matters a lot, though, to new users and to anyone helping a friend install Tor Browser for the first time.
It also creates an opening for scammers. “You’ll see a security warning, just ignore it” is now true for the genuine installer, which makes it useful advice for fake ones too. Fake Tor Browser installers have been used to steal cryptocurrency before, as we explain in Fake ‘Dark Web’ Apps in 2026. The answer is the second layer. Check the PGP signature yourself, so you’re not depending on a warning you’ve been told to ignore.
The new PGP subkey#
From this release, all Tor Browser releases are signed with a new PGP subkey. The main Tor Browser signing key stays the same, with the fingerprint EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290. But if you’ve verified downloads before, your saved copy of the key may not include the new subkey yet. If verification fails with a message saying the key is unknown, refresh the key first. The Tor Project’s verification page has a section on refreshing it, and our guide How to Download and Install Tor Browser Safely walks through the whole process.
A new subkey can look suspicious if nobody tells you about it, which is exactly why it was announced in the release post. If you ever come across a change to signing keys that the Tor Project itself hasn’t announced, stop and ask before installing anything.
The macOS build fix#
One build-system line fixes how a checksum is defined in the tools used to make the macOS disk image. It sounds like routine housekeeping, and it is, but it connects to something important. Tor Browser’s builds are designed to be reproducible, so anyone can rebuild the browser from its public source code and check that they get exactly the same files the Tor Project released. Checksums are how those comparisons are made. Every small fix like this keeps that independent checking possible, which is one of the strongest assurances a privacy tool can offer.
The lines about people#
The last few changelog entries have nothing to do with code security. They’re about the people who use Tor Browser, and the people who pay for it.
“Implement YEC 2026 Takeover”#
This line appears twice, once for desktop and once for Android. YEC stands for the year-end campaign, the Tor Project’s annual fundraising drive. A “takeover” means the browser’s start page and related screens change for a few weeks to show the campaign, usually with a request to donate.
It can feel a bit odd to see these banners in a privacy tool. But there’s a reason they’re built into the browser rather than sent by email or tracked through an ad network. Tor Browser doesn’t know who you are, and the Tor Project can’t email its users because it doesn’t have a list of them. The start page is one of the very few ways it can reach people without collecting anything about them. The campaign appears on a page that’s part of the browser, not one loaded from a tracker, and it disappears when the campaign ends.
Tor is free, open source, and maintained by a nonprofit whose funding has come from both grants and individual donations. If it’s useful to you and you can afford to give, the Tor Project’s donation page is the real one. Give only through that page or the browser’s own start page, never through a donation link sent to you in a message, because fake fundraising appeals are an easy scam to run.
“Change the 32-bit linux message to the expired version for the final 15.0 release”#
This line is a goodbye. Tor Browser has been showing a warning to people running it on 32-bit Linux, and this release changes that message to its final form, ahead of the last release in the 15.0 series. Put simply, the next major version won’t support 32-bit Linux at all.
Very few people still use 32-bit Linux, and many of those who do are on old hardware, sometimes because it’s all they have. If that’s you, the 15.0 series will keep getting updates until it ends, but after that there will be no more security fixes for you. Your options are to move to a 64-bit system if your hardware allows it, or to use Tails on a 64-bit computer, as covered in Tails 7.14. Running an unsupported browser for anything sensitive isn’t a safe choice.
Android#
The Android changes in 15.0.24 mirror the desktop ones. GeckoView, the Android form of Firefox’s engine, moves to 140.17.0esr, Tor moves to 0.4.9.13, and the year-end campaign appears on the start page. As noted above, onion names still only work on desktop. If you’re unsure whether the Tor app on your phone is genuine, see Using Tor on Android and iPhone, and for device-wide protection, our Tor VPN beta overview.
What to do, by platform#
Windows, already installed. No special action is needed. Let the automatic update run, restart the browser, and check you’re on 15.0.24 by opening the menu, then Help, then About Tor Browser.
Windows, installing for the first time. Download only from the Tor Project’s own site. For now, the download page will give you 15.0.20. Check its PGP signature, install it, connect to Tor once, and let it update itself to 15.0.24. Then restart. If you choose to download 15.0.24 directly instead, verify the signature and expect a certificate warning from Windows.
macOS and Linux. Let the automatic update run and then restart, or download 15.0.24 from the Tor Project and verify its signature with the refreshed key.
32-bit Linux. Update to 15.0.24, and start planning a move to a 64-bit system or to Tails before the 15.0 series ends.
Android. Update through Google Play, or get the new APK from the Tor Project if that’s how you installed it.
Tails. Tails 7.14, released on September 30, comes with Tor Browser 15.0.24. Upgrade Tails and you’ve got it. For the other changes, see Tails 7.14.
Whichever platform you’re on, restarting is the step people forget. Tor Browser downloads updates in the background but only applies them when it restarts, so a browser that’s been open for a week may still be running the old version.
What’s next#
- More Tor security releases. The Tor Project has said to expect them every two or three weeks for some time, and each one needs a Tor Browser release to reach you. Expect more 15.0 updates before the year is out.
- A fix for the Windows certificate. Once the renewal is complete, the download page should go back to offering the current version for Windows. We’ll update this post when it does.
- Tor Browser 16. The next major version is in alpha testing, with 16.0a13 released on October 1. Mozilla’s September advisories already covered a newer ESR branch, 153, alongside 140, so a move to a newer Firefox base is likely at some point. Alpha versions are for testing only, not for anything sensitive.
- The end of the 15.0 series. With it goes support for 32-bit Linux.
The best habit hasn’t changed. Leave automatic updates on, restart the browser now and then, and choose the security level that fits what you’re doing.
Where to go next#
- Want the full picture of September’s Tor fixes? Read Tor’s September 2026 Security Fixes: What to Update.
- Installing or verifying Tor Browser? Follow How to Download and Install Tor Browser Safely.
- Choosing how strict to be? See Tor Browser Security Levels: Standard vs Safer vs Safest.
- Contacting a newsroom securely? See News Onion Sites: BBC, DW, The Guardian and SecureDrop.
- Using Tor on a phone? Read Using Tor on Android and iPhone.
- Worried about fake installers? Read Fake ‘Dark Web’ Apps in 2026: What to Avoid.
- Want the Tor Project’s own sites over onion? See Tor Project’s Official Onion Sites.
- Looking for more official onion addresses? Browse the Official Onion Mirrors Directory.
Sources#
- New Release: Tor Browser 15.0.24, Tor Project blog, September 29, 2026, including the full changelog
- Mozilla security bulletin AV26-976, Canadian Centre for Cyber Security, September 29, 2026
- Mozilla Foundation Security Advisories, Mozilla
- Getting an Onion Name for Your SecureDrop, SecureDrop documentation
- Tor soups up onion sites with bountiful browser bump, The Register, June 2020, on onion names arriving in Tor Browser 9.5
- Why do only a handful of journalists have a clear name .onion address?, Tor Project forum
- Verifying Tor Browser, Tor Project support
- New Alpha Release: Tor Browser 16.0a13, Tor Project blog, October 1, 2026
1 comment