15 October 2024 tor network 2 min read

Tor Browser 14 and beyond: the current release picture

Tor Browser 14 landed on a rebased Firefox 128 ESR in late 2024, and the release said a lot about how this project now ships software: quietly, predictably, and with the update pipeline mattering as much as the features.

Why the rebase mattered

Every Firefox ESR rebase drags years of upstream security work into tor browser at once. The version 14 rebase brought a long list of memory-safety fixes and engine hardening that had accumulated upstream, closing the window that attackers probe for whenever a privacy browser falls behind its parent codebase. The project has also gotten faster at the unglamorous part: patch turnaround. When Firefox ships a critical fix, tor users historically waited days. The current release cadence has narrowed that gap to hours in several cases, which is exactly what you want from a browser whose users are high-value targets.

Android stopped being second-class

The android build reached genuine parity during this generation - same engine, same security slider model, same update discipline. For a large share of the world, the phone is the only computer, and the Tor Project finally treats that as a first-class platform rather than a port.

What is next on the list

The roadmap centers on three things: keeping pace with ESR rebases as mozilla shortens its support cycles, shipping the new connection-assist UX for censored regions by default, and continuing the slow migration of components toward rust - a process that mirrors the arti work happening on the network side. None of this is flashy. That is the point. A privacy browser wins by being boring, current and hard to exploit - and version 14 was the most boring, current and hard-to-exploit release yet.

EU reinstates Chat Control 1.0: message scanning returns despite a majority voting no

The European Parliament failed to block the revival of the EU's temporary voluntary message-scanning regime on July 9, 2026 - 314 MEPs opposed it, but the absolute-majority threshold was never reached. With the permanent CSAR talks resuming in September, the fight over scanning and encryption directly shapes the future of anonymity tools.

Telegram wants .gram: what happens when criminal infrastructure leaves onions for platform-controlled DNS

Telegram has applied to ICANN for the .gram top-level domain, turning usernames into resolvable domains with AI-generated sites behind them. Coming weeks after t.me was suspended under sanctions pressure, the move highlights how infrastructure is drifting away from onion services toward DNS that regulators can actually touch.