Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Cross-domain linkability when system time changed in Tor Browser#282339 | Informative | Information Disclosure | Low | 2017-10-26 | – | – |
| Crashes/Buffer at 0x2C0086,name=PBrowser::Msg_Destroy#281682 | Informative | Memory Corruption | Medium | 2017-10-24 | – | – |
| Sql query disclosure,#267922 | Informative | Information Disclosure | Low | 2017-09-18 | – | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.