CVE-2016-3180: Tor Browser Launcher Project Tor Browser Launcher

High severity, CVSS 8.1. EPSS: 1.9% chance of exploitation in the next 30 days.

Tor Browser Launcher (aka torbrowser-launcher) before 0.2.4, during the initial run, allows man-in-the-middle attackers to bypass the PGP signature verification and execute arbitrary code via a Trojan horse tar file and a signature file with the valid tarball and signature.

Affected products

• Tor Browser Launcher Project Tor Browser Launcher: version 0.2.3 only

Published 2017-02-07. Last modified 2026-06-17.