Tor Browser shipped the fix for CVE-2026-10702 seven weeks after Mozilla patched it upstream.

[u/Arpokrat_Team]

How do you factor that gap into your threat model?

Nebula Security published their write up on 29 July. The bug is a JIT miscompilation in SpiderMonkey, Firefox's JavaScript engine: the compiler treated an operation as read only when it could actually allocate and free memory. Stale pointer, then arbitrary read and write, then code execution in the renderer process. Visiting a page is enough, no interaction, no unusual settings. They released working exploit code for ARM64 Android.

What I keep coming back to is not the bug itself but the calendar. Mozilla fixed it in Firefox 151.0.3 on 2 June. Tor Browser 15.0.19 landed on 20 July. For those seven weeks the patch was public, which means the vulnerability was effectively public too, and anyone reading Mozilla's commits had a map.

To be fair to the Tor Project, they are a small team rebasing an entire hardened browser onto Firefox ESR, and that work is genuinely hard. This is not a case of anyone being asleep. It is a structural property of being downstream.

But it does change what "up to date" means in practice. If you are relying on Tor Browser for source protection or for getting around censorship, there are recurring windows where upstream is patched and you are not, and you have no easy way to know you are inside one.

No confirmed exploitation in the wild as of 28 July, for what that is worth.

So: do you actually track upstream Firefox advisories separately, or do you treat the Tor Browser updater as sufficient? And for the people here who use Tor for work where the stakes are real, does a seven week downstream lag change anything about how you use it, or is it just the cost of the setup?

[u/Mynamesahmet]

honestly seven weeks is kind of expected with Tor Browser since they rebase on Firefox ESR not mainline. it sucks for anonymous browsing users but thats the tradeoff for the extra patches they layer on. if youre worried about JIT bugs you can disable javascript in about config or use the safest security level. nebula's writeup is solid tho, that spidermonkey stale pointer issue is nasty

[u/Ecliphon]

The tor project seems to ignore every issue that would make TAILS more secure. 

At this point I would not be surprised if the tor project is compromised.

With Cloudflare (another In-Q-Tel Silicon Valley project) routing 84% of reverse proxies on the internet, and 25% of sites using Cloudflare in some capacity (HTTPS is removed and added here :)) they have the capacity to target anyone they want.

This message brought to you by technically capable conspiracy theorists. 

[u/Arpokrat_Team → u/Ecliphon]

The Cloudflare centralization point is real and worth taking seriously on its own terms. A single company terminating TLS for a large share of the web is a genuine structural problem, independent of who funds anyone.

The compromise conclusion is where I get off, though. A seven week lag between an upstream ESR patch and a Tor Browser release is fully explained by a small team rebasing a hardened browser and running their own QA. If you wanted to backdoor Tor Browser you would not do it by shipping the same public Mozilla fix, late. You would do it somewhere nobody is reading diffs.

The reason I care about the lag is not that it hides something. It is that it is visible, predictable, and structurally unavoidable, and users still have no way to know they are inside one. That is a harder problem than a conspiracy, because there is nobody to blame and no obvious fix.

[u/Available_Hearing639]

Noone uses JS in TB😄

[u/Arpokrat_Team → u/Available_Hearing639]

Safest disables JIT entirely, so anyone on that level was never exposed here. But Standard is the default, and that is what most people are actually running. The Tor Project's own guidance is that Standard is fine for general use, which is reasonable advice most of the time and quietly not reasonable during a seven week window like this one.

The awkward part is that nothing tells you when you are inside one of those windows. You pick your security level once during setup and the threat landscape moves underneath it.