# Tor Browser 16.0.1 rebases on Firefox 153.7.0esr with security fixes

> **Key takeaway:** Tor Browser 16.0.1 rebases onto Firefox 153.7.0esr, backporting security fixes and updating core components including Tor, NoScript, and zlib across all supported platforms.

**Published:** 2026-11-10T10:02:26.170251+00:00 
**Source:** Tor Project Privacy Blog 
**Category:** decentralized-p2p 
**Canonical URL:** https://fosswire.org/news/tor-browser-1601-rebases-on-firefox-15370esr-with-security-f.html 

## Summary
The Tor Project has released Tor Browser 16.0.1, a security-focused update that rebases the browser onto Firefox 153.7.0esr (Extended Support Release) version 153.7.0. This release applies backported security fixes from Firefox 160 and updates several foundational components: the underlying Tor daemon moves to 0.4.9.16, the NoScript extension upgrades to 13.6.38.1984, and zlib is updated to 1.4. The Android build receives parallel updates through GeckoView 153.7.0esr, while the build system sees changes to APK signing procedures using newer Android build tools.

All desktop platforms (Windows, macOS, Linux) and Android receive these updates. The release addresses bug reports related to the rebase process and incorporates security patches that were not present in the previous 16.0 release. Build system changes on Android specifically update the apksigner tool and add alignment preservation flags during the signing process.

## Component updates and build system changes
- **Firefox/GeckoView rebase:** Desktop builds move to Firefox 153.7.0esr and Android builds move to GeckoView 153.7.0esr, incorporating the underlying Mozilla security and stability fixes from that ESR branch.
- **Security backports:** Fixes from Firefox 160 are backported to the 153.7.0esr-based Tor Browser, addressing vulnerabilities present in the previous release without waiting for the next major ESR cycle.
- **Tor daemon update:** The bundled Tor implementation is updated to 0.4.9.16, which may include relay and client-side improvements for the anonymity network layer.
- **NoScript extension:** Updated to 13.6.38.1984, maintaining the script-blocking capability that is central to Tor Browser's security model against fingerprinting and exploitation.
- **Android build system:** The signing pipeline now uses apksigner from build-tools_r37_linux.zip and adds `--preserve-alignment true` to signing calls, which affects reproducibility and verification of Android package builds.

## Why it matters
For privacy-focused Linux users and journalists, activists, and researchers who depend on Tor Browser, this release closes a security gap by backporting Firefox fixes rather than waiting months for the next ESR transition. The zlib update to 1.4 and Tor daemon refresh also reduce the attack surface for memory corruption and network deanonymization vectors. The Android build system changes signal continued investment in reproducible builds for mobile, which strengthens supply-chain verification for the growing segment of users who access Tor primarily through mobile devices.