Privacy Compromise in Tor Browser Due to Correlation Attack Vulnerability

CVE-2021-39246

What is CVE-2021-39246?

The Tor Browser versions 10.5.6 and 11.x up to 11.0a4 are susceptible to a correlation attack that can jeopardize user privacy when visiting v2 onion addresses. This vulnerability allows the browser to log precise timestamps of visits to these onion services locally. An attacker might exploit this by matching these timestamps against data sourced from the targeted onion service or potentially from malicious sites within the Tor network, undermining the anonymity that Tor aims to provide.

References