Tor Browser 16.0a9 is now available from the Tor Browser download page and also from our distribution directory.
This version includes important security updates to Firefox.
⚠️ Reminder: The Tor Browser Alpha release-channel is for testing only. As such, Tor Browser Alpha is not intended for general use because it is more likely to include bugs affecting usability, security, and privacy.
Moreover, Tor Browser Alphas are now based on Firefox's betas. Please read more about this important change in the Future of Tor Browser Alpha blog post.
If you are an at-risk user, require strong anonymity, or just want a reliably-working browser, please stick with the stable release channel.
It's ESR transition season again!
Well actually, it has been ESR transition season throughout this entire release cycle! As described in the aforementioned Future of Tor Browser Alpha blog post, we have been incrementally rebasing our Alpha channel on Firefox betas since December of last year. As a result, we now stand before you with Tor Browser 16.0a9 which is based on Firefox ESR 153.
We will continue rebasing Tor Browser 17.0 Alpha branches on Firefox betas throughout the remainder of the Tor Browser 16.0 release cycle. However, new feature-work for now must be put on hold for a few reasons:
- We must focus our attention on resolving our Bugzilla Audit issues to ensure the features we have inherited from upstream comply Tor Browser's threat model and to patch any changes which do not.
- Feature work targeting 16.0 stable would need to be cherry-pick'd onto our 17.0 Alpha branches to ensure we don't lose any work. The more invasive a feature patch is, the harder it will be to port to newer versions. This would also be a potentially error-prone process and there is some risk we would lose patches along the way.
- We need to finish stabilizing as soon as possible as we have hard external deadlines which cannot be moved: the end-of-life of Firefox ESR 140 on October 13th and the Google Play Minimum Target API Level requirement on November 1st
Challenges and Triumphs
💍 Sharing the Load
Rebasing the hundreds of Tor Browser patches onto newer versions of Firefox is a challenging task. It is like maintaining the structural stability of sand-castle at high-tide with the waves crashing all around you.
As such, it quickly become clear early in this new process that we would need to do something if we wanted to avoid burning out the few developers typically involved in this work. To mitigate this, we shared the knowledge internally and spread the work out across all eight members of the team. This way, each developer was only responsible for at most two or three rebases throughout the entire release cycle.
🎨 UI Code Churn
Over the past year, Firefox has developed and integrated two major changes to the UI in Firefox: a redesign of about:preferences in Firefox Desktop and a migration from Material 2 to Material 3 in Firefox Android.
Adapting to these types of changes to the frontend are typically rather time-consuming for us, as many (if not the majority) of our patches modify Firefox's UI in some way. For example, we have an entire preferences page on Tor Browser desktop dedicated to configuring how the browser connects to the Tor Network. On Android, we similarly have various additions to the menus, configuration options, and custom UI.
Whenever Mozilla modifies their design systems and Firefox's user interface, we necessarily have to adapt our own custom additions to match. Otherwise, our Tor Browser-specific UI elements would look completely out of place and potentially confuse users (as well as simply looking unprofessional). Therefore, each of these upstream changes requires collaboration with the Tor Project's UX team to update our features' designs and of course development time to implement.
In addition to the time-cost associated with the extra engineering and UX collaboration, very often our old patches simply do not apply cleanly due to the amount of code which has changed. For example, the about:preferences changes on Firefox Desktop are essentially a complete re-write which means we also have to completely re-write our own settings changes without regressing in functionality.
On the plus side, one benefit of our new processes is that we have been able to spread out this work over the entire release cycle. In the past way of doing things, we would have discovered all UX elements which needed to be fixed, updated our designs, and re-implemented in the course of a few months during the old ESR transition season. Under this new way of working, we have been able to incrementally fix things throughout the development cycle.
The benefits of working this way does not just apply to UX of course. It is much easier to find regressions across the entire stack when rebasing between one major Firefox version at a time instead of across 12 or 13. It is also much easier for developers to fix individual regressions one at a time compared to diagnosing, disentangling, and fixing multiple bugs concurrently (divide et impera!).
⚙️ Pending Google Target API Level Requirements
Every year, Google requires new Android app releases to target an updated minimum API level. This means, we would not be able to upload new versions of Tor Browser Stable past a certain date (usually August 1st with an extension to November 1st typically possible) without first updating the app to support the new minimum target API level. Fortunately, we inherit most of the required changes from Mozilla when rebasing to the next major ESR.
However, this requirement does impose a hard deadline for the absolute latest we can responsibly stabilize Tor Browser Alpha and promote it to Stable. We've been fortunate in the past few years to make the deadline with a few days to spare (October 28th for Tor Browser 15, October 22nd for Tor Browser 14, etc). Given how far ahead of the curve we are this year, we are hoping to release about a month earlier in September (fingers crossed!).
🤖 Android APKs too big
The Google Play Store has a strict size limit of about 100 megabytes for Android applications. New functionality added to Firefox Android over the past year means a larger application which results in new headaches for Tor Browser developers. This release cycle was no exception to this rule and we have had to get creative with our size reductions.
In the past, we have been able reduce our package size though various methods including:
- Using custom size-reducing compiler flags
- Compiling multiple pluggable-transports into a single unified binary to de-duplicate shared dependencies
- Removing unused Firefox assets from the build
- Replacing unused (but still linked) libraries with no-op stubs
- and countless other methods over there years
Our most recent effort has been the most invasive yet! For some background, the Firefox application consists of (among other things): various shared libraries, the Firefox executable, a library known as 'xul' which contains most of Firefox's natively compiled functionality, and finally a file known as omni.ja
. This omni.ja
file is a zip
archive which contains the JavaScript, HTML, images, and other assets used in Firefox.
This time around, to reduce the size of our Android package we havechanged how this archive is compressed. We modified the Firefox build system to compress this archive with xz
and we modified Firefox itself to decompress this archive at runtime. This work did require a few iterations to get right. In the end, we got back about 3 megabytes with these changes and got us once again under Google's imposed size budget.
📉 Even Less Telemetry
Over the years, we have worked to incrementally remove dependencies from Tor Browser Android as part of the aforementioned size reduction work. We of course inherit most of these dependencies from Firefox Android and unfortunately some of them can be labeled as 'trackers'. While we do disable telemetry by default at runtime, the code which implements it remains in the codebase.
We're happy to report that as of Tor Browser 16.0a8, are down to only 1 'tracker' library in the Tor Browser Android codebase: Mozilla Telemetry
. Again, this telemetry is disabled at runtime, but this is one more unused dependency which we can hopefully remove in the future (and maybe get some more bytes back!).
Current Status
We have:
- incrementally rebased Tor Browser and Tor Browser for Android to Firefox ESR 153 from Firefox ESR 140
- updated the build systems with the latest dependencies and fixed a few reproducibility issues
- triaged most of the upstream changes from the past year and flagged over 250 issues for further review (triaging of Firefox 153 is in progress)
- resolved about half of these triaged issues
For the remainder of this release cycle, we will be focusing on auditing these issues and fixing bugs until the 16.0 alpha series is ready to become Tor Browser Stable 16.0. We are optimistically targeting a September release, which would put us one month ahead of schedule compared to last year.
Known Issues
🦊 Firefox Branding
In some places in the browser there may be Firefox branding (e.g. logos, cute little foxes, etc) instead of Tor Browser branding. We're currently tracking one known instance in tor-browser#44998. If you discover any other instances lurking about, please open an issue!
🌐 All websites marked 'insecure' on Tor Browser Android
Currently, the identity block in the URL bar on Tor Browser Android will always report insecure (e.g. a shield icon with a slash through it). For now, you can tap this icon and verify the certificate manually. This issue is being tracked in tor-browser#45115
Send us your feedback
Now is a great time to become an alpha tester! If you find a bug or have a suggestion for how we could improve this release, please let us know.
Full changelog
The full changelog since Tor Browser 16.0a8 is:
- All Platforms
- Updated NoScript to 13.6.30.90201984
- Bug tor-browser#43819: Show custom security level on android
- Bug tor-browser#44748: Revert Funding the Commons Implementations
- Bug tor-browser#44811: Remove the lock on pdfjs.disable.
- Bug tor-browser#45101: Rebase Tor Browser onto 153.0esr
- Bug tor-browser#45131: Security level is using an unsafe getBoolPref
- Bug tor-browser-build#41831: Update libevent to 2.1.13
- Windows + macOS + Linux
- Updated Firefox to 153.0esr
- Bug tor-browser#44439: Remove translate action from urlbar
- Bug tor-browser#44883: Remove urlbar quick action for labs
- Bug tor-browser#45029: Convert connection status settings to new design and config approach
- Bug tor-browser#45055: Rename --color-gray-05 to --color-gray-0
- Bug tor-browser#45081: Use the new "Acorn" icons on desktop
- Bug tor-browser#45110: Disable the settings redesign until ready for us
- Bug tor-browser#45112: Missing CSS border tokens in 153
- Bug tor-browser#45132: nsAppFileLocationProvider.cpp: use of undeclared identifier 'XRE_EXECUTABLE_FILE'
- Bug tor-browser-build#41800: Create a script that adapts the Tor Browser manual HTMLs to work in Tor Browser
- macOS
- Bug tor-browser#45108: Artifact generation fails due to missing .DS_Store in the branding directories
- Android
- Updated GeckoView to 153.0esr
- Bug tor-browser#43820: Use SecurityLevel integration on android
- Bug tor-browser#44157: Remove secret setting toggle for Tab Management Redesign
- Bug tor-browser#45045: Remove moz asset in Downloads screen
- Bug tor-browser#45103: Disable broken "tab management"
- Bug tor-browser#45109: No value passed for parameter 'jsEnabled'
- Bug tor-browser#45118: Audit and disable Mozilla VPN promo
- Bug tor-browser#45130: Clean up TorHomePage padding
- Build System
- All Platforms
- Bug tor-browser-build#41838: Update personal_access_tokens URL in tools/fetch_changelogs.py
- Windows + Linux + Android
- Updated Go to 1.26.5
- Windows
- Bug tor-browser-build#41819: Fix windows-rs URL in projects/firefox/config
- All Platforms
Comments
We encourage respectful, on-topic comments. Comments that violate our Code of Conduct will be deleted. Off-topic comments may be deleted at the discretion of the moderators. Please do not comment as a way to receive support or to report bugs on a post unrelated to a release. If you are looking for support, please see our FAQ, user support forum or ways to get in touch with us.