Browser Privacy Ranking 2026: Tor Browser Leads at 9.5 While Chrome and Yandex Rank Lowest
SecurityLab.ru has released its 2026 browser privacy ranking that measures real behavior rather than marketing claims. The evaluation uses six criteria: network activity immediately after installation, cross-site state isolation, resistance to browser fingerprinting, funding model, depth of configurability, and code verifiability together with the fate of content blockers.
Tor Browser 15.0 tops the list with a score of 9.5. It unifies the fingerprint, letterboxes the window, and applies JavaScript protections at multiple security levels while routing traffic through the Tor network. The 15.0 release, based on Firefox ESR 140, removed AI features and added a non-AI DuckDuckGo option.
Mullvad Browser 15.0 follows at 9.0 with the same anti-fingerprinting engine but without the Tor network, offering constant private mode and zero telemetry. LibreWolf 153.0 scores 8.5 by stripping Mozilla telemetry, pre-installing uBlock Origin, and enabling fingerprint resistance by default.
Brave 1.93 receives 7.5 for its Shields system that blocks ads and trackers at the engine level, bypassing Manifest V3 restrictions. However, it ships with P3A telemetry enabled and includes cryptocurrency features that must be disabled manually. Ungoogled Chromium 150.0 scores 7.0 for sending zero requests to Google services yet ships without any built-in ad or tracker blocking.
DuckDuckGo Browser 1.202 earns 6.5 for immediate tracker protection but still allows requests to bat.bing.com under a Microsoft syndication agreement. Safari 26.5 and Firefox 153.0 both score 6.0 out of the box; Firefox can reach 8.5 after about an hour of about:config tuning and container extensions.
Lower scores go to Vivaldi 8.1 (4.5) for its daily unique profile identifier, Microsoft Edge 151.0 (3.0) for extensive Microsoft telemetry and Copilot integration, Google Chrome 151.0 (2.5) for sending every address-bar character to Google and abandoning third-party cookie changes, Opera 134.0 (2.0) for sending visited URLs to sitecheck.opera.com, and Yandex Browser (1.5) for hardware identifiers and deep ecosystem integration.
The report also covers the Local Mess technique disclosed in June 2025 that allowed Meta Pixel and Yandex Metrika scripts to exfiltrate cookies via localhost connections to mobile apps, bypassing all browser isolation mechanisms including incognito mode.
Related articles
Russian Ministry Certificates Enable Potential State MITM on Foreign Domains
Russian companies facing sanctions have started adopting root certificates issued by the Ministry of Digital Development and Communications to maintain HTTPS access after commercial CAs revoked or refused to renew their certificates. Installing these Ministry certificates allows browsers to trust sites using Russian national CAs but also creates a pathway for man-in-the-middle interception by state-controlled entities. The article details a concrete threat model where a government-linked operator could use the Ministry root to generate on-the-fly certificates for any domain, including foreign services outside Russian jurisdiction. To mitigate this, the author demonstrates how to re-sign the Ministry root with OpenSSL nameConstraints limited to .ru, .su, and .рф domains only. Tests on macOS with Homebrew show that the constrained certificate still validates Russian banking sites such as online.sberbank.ru while correctly rejecting attempts to validate foreign domains like sberbank.com. The technique requires users to maintain their own cross-signed root and never rely on pre-installed Ministry or Yandex Browser roots for full protection.
Bypassing Blocks, Privacy, and Anonymity Remain Separate Challenges for Decentralized Networks
The developers of the decentralized circumvention tool Tunnel Cat have clarified that their service addresses only traffic delivery and does not guarantee privacy or anonymity. Transport-layer TLS encryption protects data in transit between nodes but provides no end-to-end protection for conversation content. The team explicitly recommends using separate E2E-encrypted messengers such as Signal or Matrix rather than relying on Telegram. Operational telemetry is retained to comply with legal obligations in multiple jurisdictions and to monitor blocking patterns inside Russia. Because client devices relay traffic for others, the architecture inherently prevents strong anonymity guarantees comparable to Tor. The project deliberately separates the circumvention function from messaging and anonymity tools to avoid overpromising security properties.
How to Detect and Remove Stolen Photos from Fake Profiles, Listings and Ads
Photos are frequently stolen from social networks, old listings, building chats and review sites, then reused in fake profiles, advertisements and rental scams. Russian law under Article 152.1 of the Civil Code protects the right to one's image, while separate copyright rules protect the photographer. Victims are advised to gather strong evidence including full-page screenshots, PDF copies and original files before contacting platforms. Search tools such as Yandex Images, Google Lens and TinEye help locate copies across multiple services. Complaints can be filed directly with site administrators on VKontakte, Odnoklassniki, Avito and Telegram, or escalated to Roskomnadzor and police when personal data or fraud is involved. Preventive steps include lowering image resolution, adding watermarks and restricting album visibility through privacy settings.
Configuration Drift Silently Breaks Multi-Hop Chains in sing-box Reality Fleet
A post-mortem analysis of a censorship circumvention network using sing-box and Reality revealed that four out of seven nodes were unreachable due to outdated allowlists, even though all monitoring reported green status. The fleet consisted of 14 endpoints across seven machines and four providers, with traffic routed in two hops where entry nodes only knew client identities and exit nodes only knew destinations. White-list rules on entry nodes permitted only five addresses instead of all required relays, causing urltest to silently discard most chains without logging failures. Canary checks, external probes, and the relay-lockdown.sh script all passed because none compared the allowlist against the full signed configuration. Two private paid nodes lacked any route section entirely, exposing them to potential abuse. The issue stemmed from configuration drift over time, with no single person maintaining an overview of the entire system. Automated fixes were implemented with safeguards to prevent fleet-wide lockouts.