Tor Browser 16.0.1 is a security update: Firefox 153.7.0esr and a same-day Android fix
Tor Browser 16.0.1 is out, and the project is calling it what it is: an important security update to Firefox. The build landed on November 10, 2026, less than two weeks after 16.0 became the first stable Tor Browser on the Firefox ESR 153 line, and it moves the browser engine to Firefox and GeckoView 153.7.0esr. The bundled tor client is now 0.4.9.16 and NoScript is 13.6.38.1984, according to the release announcement.
What changed in 16.0.1
On desktop, the Windows, macOS and Linux builds all move to Firefox 153.7.0esr; on Android the same version arrives as GeckoView 153.7.0esr. The rebase is tracked as tor-browser#45439. Alongside it the release bumps zlib to 1.4 and changes two things in the Android build system: a new apksigner taken from build-tools_r37_linux.zip, and the addition of --preserve-alignment true to the apksigner signing calls. Neither of those is user-visible, but both matter for how the Android packages are produced and signed. The substantive item is a backport. The changelog lists a backport of security fixes from Firefox 160 under tor-browser#45442, which means fixes Mozilla shipped in a later Firefox release have been pulled back into the 153 ESR branch that Tor Browser is built on. Tor Browser does not track Firefox's rapid release channel, so this is the normal route for getting a security fix to users before the next ESR cycle.Why a point release still matters
Tor Browser inherits its engine from Firefox ESR, and ESR branches receive security fixes on a slower cadence than the main release channel. That makes point releases like 16.0.1 the moment when those fixes actually reach Tor users. Anyone still on 16.0 is running Firefox 153.6.0esr underneath, one ESR security step behind. The gap is small in version numbers and not small in kind: the fixes being backported are the ones Mozilla judged worth shipping to everyone.This release includes important security updates to Firefox.That sentence is the whole justification for updating promptly. There is no new feature to weigh, no interface change to get used to, and no configuration to revisit. The update is a maintenance release in the strict sense, and the only reason to delay it would be a specific compatibility problem, which the changelog does not describe.
A same-day Android-only fix
Tor Browser 16.0.2 shipped the same day, November 10, and it is Android only. The release notes describe a platform-specific breakage caused by a zlib update, and the changelog entry is blunt about the mechanism: Android 16.0.1's tor picked up the dynamic zlib (tor-browser-build#41919). In other words, the tor binary in the Android package resolved zlib at runtime instead of using a bundled copy, and a zlib change in the build environment left it pointing at something it was not built against. The 16.0.1 changelog also lists a zlib bump to 1.4, which lines up with the 16.0.2 note. The lesson is about packaging rather than about Tor itself. Desktop bundles ship a self-contained tor with its dependencies pinned; on Android the same component can end up dynamically linked against a library supplied by the build or the platform, and then an unrelated version bump becomes a runtime failure. It is the kind of bug that only shows up on one platform, which is why the fix was scoped to Android and shipped within hours rather than folded into the next scheduled release.How to confirm you are on the right build
The download page and the distribution directory both carry 16.0.1, and the directory listing shows builds for Windows (i686 and x86_64), macOS, Linux (x86_64 and aarch64) and Android (aarch64, armv7 and x86_64), plus incremental update packages from 15.0.25, 15.0.26 and 16.0. The source archive is named src-firefox-tor-browser-153.7.0esr-16.0-1-build2.tar.xz, which confirms the ESR base in the filename itself.- Check the version in the browser's about dialog; it should read 16.0.1 on desktop and 16.0.2 on Android.
- Compare your download against sha256sums-signed-build.txt in the 16.0.1 directory, and check the matching .asc signature.
- If you use the built-in updater, confirm the incremental MAR applied rather than a full reinstall.
- On Android, take 16.0.2 rather than 16.0.1, since the earlier build carries the zlib problem.