Tor Browser 14.5a6 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

We would like to thank the folowing community members for their contributions this release:

• cschutijser for their fixup to tor-browser#43628

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 14.5a5 is:

• All Platforms
  • Updated Tor to 0.4.9.2-alpha
  • Bug tor-browser#43322: Stop blocking all fonts in FontFace
  • Bug tor-browser#43443: Drop effective top level domain for au.securedrop.tor.onion
  • Bug tor-browser#43585: Rebase Tor Browser alpha onto 128.9.0esr
  • Bug tor-browser#43601: Backport security fixes from Firefox 137
  • Bug tor-browser#43628: Handle unavailability of NetworkLinkService API in Tor Connect
  • Bug tor-browser-build#41425: Snowflake needs to be listed separately on torrc-defaults
• Windows + macOS + Linux
  • Updated Firefox to 128.9.0esr
  • Bug tor-browser#41919: Add temporarily visible web content-size overlay after resizing window when letterboxing is enabled
  • Bug tor-browser#43130: Adjust preferences for contrast theme or forced colors
  • Bug tor-browser#43531: Use "label" attribute rather than textContent for the bridge dialog XUL buttons
  • Bug tor-browser#43563: TorConnect country/region names should change based on the app language
• Android
  • Updated GeckoView to 128.9.0esr
  • Bug tor-browser#43464: TBA Alpha and Nightly cannot be debugged with about:debugging
  • Bug tor-browser#43565: The quit button on Android doesn't actually exit
  • Bug tor-browser#43576: Connection Assist on Android Polish
  • Bug tor-browser#43581: Bookmarks are failing to load on Tor Browser Android Alpha 14.5a5
  • Bug tor-browser#43593: Use "region" instead of "country" in connect assist
  • Bug tor-browser#43604: TorDomainIsolator routinely clears Android browser circuit data
  • Bug tor-browser-build#41422: Patch viaduct in Application Services to always return a backend error
• Build System
  • All Platforms
    • Updated Go to 1.23.8
    • Bug tor-browser-build#41365: Indent download*.json files
    • Bug tor-browser-build#41406: Restore -desktop and -android Makefile targets.
    • Bug tor-browser-build#41407: Use Lyrebird also for the Snowflake PT
    • Bug tor-browser-build#41409: Create a script for quickly setting up protected branches
    • Bug tor-browser-build#41411: Update licenses for PTs
    • Bug tor-browser-build#41417: Bump the conjure version we ship
    • Bug tor-browser-build#41419: Add comment in downloads.json to mention that the file is deprecated, and that download-$platform.json should be used instead
    • Bug tor-browser-build#41420: Update the changelog script for label updates
    • Bug tor-browser-build#41426: Set the Lyrebird version
    • Bug rbm#40083: rbm creates out/$project directories with mode 0700
  • macOS
    • Bug tor-browser-build#41403: The rcodesign step has a wrong dmg name in alpha
  • Android
    • Bug tor-browser-build#41400: Add branding localization to GeckoView
    • Bug tor-browser-build#41410: Use the Lyrebird name on Android