Tor Browser 15.0.25 ships Firefox security backports: what the update actually changes for users
The Tor Project shipped Tor Browser 15.0.25 on 12 October 2026, and the line that matters most sits quietly in the changelog: a backport of security fixes from Firefox 158. The browser is available from the official download page and from the project's distribution directory, and the announcement keeps the framing plain: this version exists, first and foremost, to carry Firefox security updates to Tor users.
This version includes important security updates to Firefox.That sentence, quoted from the release post, undersells the content. Alongside the Firefox backport, 15.0.25 updates the Tor daemon itself, refreshes two security-relevant libraries and quietly changes the Windows code-signing certificate used for the executable.
What is actually in 15.0.25
The full changelog since Tor Browser 15.0.24, as published on the project forum and the Tor blog, reads as follows:- Tor updated to 0.4.9.14
- NoScript updated to 13.6.36.1984
- OpenSSL updated to 3.5.9
- Backport of security fixes from Firefox 158 (tor-browser issue #45382)
- Build system: the Windows sign-exe wrapper now uses a new Windows signing certificate
The Firefox 158 advisory behind the backport
Mozilla announced the underlying fixes on 13 October in MFSA 2026-106 for Firefox 158, with an overall impact rating of high. The high-severity list is long and dominated by the classic exploit classes: privilege escalation in the Application Update component (CVE-2026-109704), several sandbox escapes and use-after-free bugs in the Networking component, a use-after-free in IndexedDB storage, JIT miscompilation in WebAssembly and a series of boundary-condition bugs in the JavaScript engine, many credited to Amy Burnett of OpenAI. The matching extended-support advisory, MFSA 2026-108 for Firefox ESR 153.5, carries the same high-impact set, and that ESR line is the branch Tor Browser builds on. One caveat belongs here: the Tor release post does not enumerate which individual CVEs made it into the 15.0.25 backport, so the changelog entry should be read as a bundle rather than a per-bug map.Why the fixes arrive with Mozilla's, not months later
Tor Browser is a patched build of Firefox: every Mozilla fix has to be ported onto the Tor-specific codebase, checked against the privacy and fingerprinting patches, rebuilt for every platform and signed before the project publishes it. That pipeline costs days rather than months. This time the gap was minimal: the Tor blog post is dated 12 October and Mozilla's matching advisories are dated 13 October, and the alpha channel had already moved on to 16.0a14 by mid-month. The pipeline also keeps moving. On 20 October Mozilla published follow-up advisories for Firefox 158.0.1, Firefox ESR 153.5.1 and Firefox ESR 115.43.1, so further packaging work on the Tor side is likely. As of writing, no corresponding stable Tor Browser release had been announced.The practical update routine
For most users the routine is short:- Check your version in the browser menu. Anything at 15.0.24 or older lacks this backport.
- Update in place through the built-in updater, or install a fresh copy from the official download page.
- If you install fresh, take the extra minute to read how to verify Tor downloads properly before running the installer.
- Leave the bundled security settings alone. The download page repeats the standing advice: additional add-ons can bypass Tor or compromise privacy, and the browser already ships HTTPS-Only mode and NoScript.