Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Tor Browser: iframe with `data:` uri has access to parent window#358005	Informative	No weakness recorded	High	2018-06-06	–	–
Stack overflow in UnbindFromTree (browser can be crashed remotely)#264481	Informative	Memory Corruption	High	2017-10-02	–	1
Information Exposure Through Directory Listing#1316412	N/A	Information Disclosure	High	2021-08-27	–	3
Tor Browser using --log or --verbose logs the exact connection time a client connects to any v2 domains.#1250273	Informative	Information Disclosure	High	2021-09-27	–	4
[Android org.torproject.android] Possible to force list of bridges#252626	Informative	Access Control	High	2017-08-21	–	13
Address Bar Spoofing on TOR Browser#275960	Informative	Input Validation and Logic	High	2023-01-02	–	14
Access to local file system using javascript#258630	Valid	Misconfiguration and Insecure Design	High	2017-11-18	–	15
De-anonymization by visiting specially crafted bookmark.#294364	Valid	Information Disclosure	High	2018-07-03	–	15
Snowflake server: Leak of TLS packets from other clientsAnalysed#1880610	Valid	Information Disclosure	High	2023-03-15	–	30

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.