A new cybersecurity flaw has been discovered recently. TorMoil, as the flaw is known, has a lot to do with how Firefox handles local file-based addresses.
Because of this, millions of real IP addresses may have been exposed. The bug was discovered by We Are Segment, a cybersecurity company, and it works like this: when a user visits a local file address, beginning with file:// instead of the usual http://, the operating system may directly connect to the remote host, completely bypassing Tor’s anonymity, according to the short vulnerability disclosure report.
Tor’s developers immediately responded by issuing a fix for Linux and macOS users, most of whom are affected by the newly-discovered exploit. However, do keep in mind this is much more of a temporary fix than it is a permanent one; the developers only partially fixed this by blocking file:// requests in the Tor browser.
Originally, the bug stems from Firefox and not Tor, it’s just that a lot of its code is shared with the Tor Project. The security researchers and Tor developers strongly urge users to update their version of the browser as soon as possible. Until then, a lot of the bug details will be kept under wraps, at least until the majority of users decide to apply the patch.
The good news is that no evidence suggests that the bug has been exploited in the wild. If you’re planning to continue using the software, it may be better to wait until Monday when a permanent fix is expected.