Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser

Researchers demonstrated that a single malicious webpage visit can compromise the Tor Browser, highlighting that serious JIT and memory corruption vulnerabilities are not unique to Firefox. The finding challenges the assumption that switching Tor to Chromium would eliminate this threat category, as V8 vulnerabilities have been weaponized in real attacks. Tor users remain valuable targets despite the browser's smaller market share.

There’s a reason I specifically referred to confirmed in the wild exploitation rather than vulnerability totals. Google’s budget, AI tooling which Mozilla is also using and bigger research system can explain why more Chromium vulnerabilities are discovered and reported. Chromium’s market share also helps explain why attackers target it more frequently. But none of that changes my actual point, V8 vulnerabilities have been weaponized and exploited in real attacks. I never said this makes Firefox is inherently more secure. I was trying to say serious and exploitable JIT and memory corruption issues are not unique to Firefox, so claiming Tor would avoid this entire category of threat by switching to Chromium is wrong. Firefox may even benefit somewhat from being a smaller general purpose target, but Tor itself certainly does not fly under the radar. Its users can be particularly valuable targets, regardless of its overall market share. And comparing Firefox to TempleOS is a false equivalence. That’s like calling the Mets a neighborhood softball team because the Yankees have more fans. Chromium’s lead is enormous, but Firefox is still playing in the major leagues and not exactly running out of somebody’s basement.