Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Linux TBB SFTP URI allows local IP disclosureAnalysed#253429 | Valid | Information Disclosure | Critical | 2017-10-25 | $3,000 | 71 |
| Detecting Tor Browser UI LanguageAnalysed#282748 | Valid | Information Disclosure | Low | 2019-05-21 | – | 64 |
| Snowflake server: Leak of TLS packets from other clientsAnalysed#1880610 | Valid | Information Disclosure | High | 2023-03-15 | – | 30 |
| Scrollbar Width permits detecting browser platform#252580 | Valid | Information Disclosure | Low | 2017-10-20 | – | 29 |
| Potential IP revealing using UNC Path in Windows File Picker#376004 | Informative | Information Disclosure | Low | 2023-11-28 | – | 25 |
| De-anonymization by visiting specially crafted bookmark.#294364 | Valid | Information Disclosure | High | 2018-07-03 | – | 15 |
| Detect Tor Browser's language#588239 | Valid | Information Disclosure | None | 2019-05-29 | – | 11 |
| 16 instances where return value of OpenSSL i2d_RSAPublicKey is discarded -- might lead to use of uninitialized memory#142773 | Valid | Information Disclosure | – | 2017-11-26 | – | 11 |
| languagechange event fires simultaneously on all tabs#257942 | Valid | Information Disclosure | Low | 2017-10-19 | $100 | 10 |
| Simple CSS line-height identifies platform#256647 | Valid | Information Disclosure | Low | 2017-10-20 | – | 10 |
| Tor Project - Full Path Disclosure#269426 | Informative | Information Disclosure | Low | 2023-11-28 | – | 5 |
| Tor Browser using --log or --verbose logs the exact connection time a client connects to any v2 domains.#1250273 | Informative | Information Disclosure | High | 2021-09-27 | – | 4 |
| Information Exposure Through Directory Listing#1316412 | N/A | Information Disclosure | High | 2021-08-27 | – | 3 |
| Preferred language option fingerprinting issue in Tor Browser#281597 | Informative | Information Disclosure | Low | 2017-10-24 | – | 3 |
| Cross-domain linkability when system time changed in Tor Browser#282339 | Informative | Information Disclosure | Low | 2017-10-26 | – | – |
| Sql query disclosure,#267922 | Informative | Information Disclosure | Low | 2017-09-18 | – | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,187 analysed so far), which can be wrong. Data as of 2026-11-15.