Tor Browser up to and including 10.5.6 and 11.x up to and including 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamps of these onion-service visits are logged locally, and an attacker might be able to compare them to timestamp data collected by the destination server (or collected by a rogue site within the Tor network).
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
torproject tor_browser |
||
torproject tor_browser 11.0 |
Vulmon