VulnerabilityModified
CVE-2019-12383
Tor Browser before 8.0.1 has an information exposure vulnerability.
MEDIUM 4.3EPSS 2.16%
Does this matter?
Lower severity and a low EPSS score (2.16%). Track it; it rarely justifies an emergency change on its own.
Description
Tor Browser before 8.0.1 has an information exposure vulnerability. It allows remote attackers to detect the browser's UI locale by measuring a button width, even if the user has a "Don't send my language" setting.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- EPSS
- 2.16% probability · 82th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-203
- Affected
- torproject/tor browser
- Source
- cve@mitre.org
EPSS 2.2% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://www.securityfocus.com/bid/108484Broken Link, Third Party Advisory, VDB Entry
- https://gitweb.torproject.org/tor-browser.git/commit/?id=cbb04b72c68272c2de42f157d40cd7d29a6b7b55Mailing List, Patch, Third Party Advisory
- https://hackerone.com/reports/282748Issue Tracking, Third Party Advisory
- https://trac.torproject.org/projects/tor/ticket/24056Vendor Advisory
- http://www.securityfocus.com/bid/108484Broken Link, Third Party Advisory, VDB Entry
- https://gitweb.torproject.org/tor-browser.git/commit/?id=cbb04b72c68272c2de42f157d40cd7d29a6b7b55Mailing List, Patch, Third Party Advisory
- https://hackerone.com/reports/282748Issue Tracking, Third Party Advisory
- https://trac.torproject.org/projects/tor/ticket/24056Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.