# Download Mullvad Browser

> Mullvad Browser is a privacy-focused web browser developed in collaboration between Mullvad VPN and the Tor Project. It's produced to minimize tracking and fingerprinting.

- Canonical page: https://everyversion.net/mullvad-browser/
- Publisher: Mullvad VPN
- Latest: Windows 16.0, macOS 16.0, Linux 16.0 (Windows build released 2026-10-29)
- Platforms: Windows, macOS, Linux
- License: MPL-2.0 (https://github.com/mullvad/mullvad-browser/blob/14.0.7/LICENSE)
- Price: Free and open source
- Website: https://mullvad.net/browser
- Support: https://mullvad.net/help

- winget ID: MullvadVPN.MullvadBrowser

- Homebrew cask: mullvad-browser
- Flathub: net.mullvad.MullvadBrowser — https://flathub.org/apps/net.mullvad.MullvadBrowser (app data from Flathub; license listed there: MPL-2.0)
- Flathub publisher verified: no (The ownership of the net.mullvad.MullvadBrowser app ID has not been verified and it may be a community package.)
- Verification: level 1 — Hashes re-computed from the publisher’s download: 2 of 2 installers match the upstream manifest. Checked by Cristian Gonzalez Guasch.
- Source (Windows): winget-pkgs @ cfb57c8683c26a093b5e5463176d73278d64bf0b — https://github.com/microsoft/winget-pkgs/tree/cfb57c8683c26a093b5e5463176d73278d64bf0b/manifests/m/MullvadVPN/MullvadBrowser
- Source (macOS): Homebrew cask @ dcaa56add9b3eb423fe6a1037d47d207d248cc23 — https://github.com/Homebrew/homebrew-cask/blob/dcaa56add9b3eb423fe6a1037d47d207d248cc23/Casks/m/mullvad-browser.rb
- Source (Linux): Flathub — https://github.com/flathub/net.mullvad.MullvadBrowser

## Description

When you visit a website, you can be identified and tracked through your IP address, third-party cookies, all kinds of tracking scripts, and through so called browser fingerprints. That’s why masking your IP address is not enough to stop the data collection. However, by using a trustworthy VPN in combination with a privacy-focused browser, you can put up a better resistance against the mass surveillance of today. That's why we partnered with the Tor Project to develop Mullvad Browser – a browser designed to minimize tracking and fingerprints.

## Windows

### What the installer does
- Delivered as an NSIS (Nullsoft) setup program (.exe) for x64.
- Installs for the current user only, so administrator rights are normally not needed.
- No custom silent switch is declared; winget falls back to its default for this installer type (`/S`).
- Upgrades install over the existing version.

### Versions (newest first)

#### 16.0 — 2026-10-29

- x64 nullsoft (user): mullvad-browser-windows-x86_64-16.0.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/16.0/mullvad-browser-windows-x86_64-16.0.exe
  - sha256: 4b60828972ba5dca193ccc5a9fd47af811873c390aa59bc6d7d93ec1eb39b44d
Release notes: - All Platforms - Updated Firefox to 151.0a1 - Updated NoScript to 13.6.19.90401984 - Updated uBlock Origin to 1.71.0 - Bug 43824: Switch resource:// modules to use moz-src: [tor-browser] - Bug 44630: Use settings config to hide settings, rather than data-hidden-from-search or commenting out [tor-browser] - Bug 44829: Hide the settings privacy card [tor-browser] - Bug 44869: Rebase alpha onto 151 [tor-browser] - Bug 44903: Use the support-page instead of tor-manual-page in moz-support-link [tor-browser] - Bug 44989: Backport Bug 2040704: Fix date format leak in Firefox 151 [tor-browser] - Bug 44990: CI failing due to dubious ownership of cached repo [tor-browser] - Bug 44999: Privacy settings are broken in 151 [tor-browser] - Windows - Bug 44745: Change how we hide SSO setting for windows [tor-browser] Build System - All Platforms - Bug 41779: Update toolchains for Firefox 151 [tor-browser-build] - Bug 41781: Fix clean section in rbm.local.conf.example [tor-browser-build] - Bug 41792: Switch from ftp.gnu.org to ftpmirror.gnu.org [tor-browser-build] - Bug 41806: make list_toolchain_updates should check var/firefox_platform_version [tor-browser-build] - Bug 41807: Incorrectly generated Bugzilla query link in generate-bugzilla-triage-csv.py [tor-browser-build] - Windows - Bug 41810: Define GetAddrInfoExCancel on mingw [tor-browser-build] - macOS - Bug 41793: Stop copying permissions from .mar in dmg2mar [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 16.0 --exact`

#### 15.0.26 — 2026-10-21

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.26.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.26/mullvad-browser-windows-x86_64-15.0.26.exe
  - sha256: acb32d9e834006d1e25da7ab55f94ff29b1dc738e0130829dda1d88b7f46f9f0
Release notes: - All Platforms - Bug 45397: Update CA intermediates and other settings dumps [tor-browser]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.26 --exact`

#### 15.0.25 — 2026-10-14

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.25.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.25/mullvad-browser-windows-x86_64-15.0.25.exe
  - sha256: 47165100223852119fb12a3e52ca7a254aa94e6d0da5f2aff11ba96a2beb5549
Release notes: - All Platforms - Updated NoScript to 13.6.36.1984 - Bug 45382: Backport Security Fixes from 158 [tor-browser] Build System - All Platforms - Bug 41885: Update changelogs as a last step in relprep.py [tor-browser-build] - Windows - Bug 41890: Update sign-exe wrapper to use new Windows signing cert [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.25 --exact`

#### 15.0.24 — 2026-09-30

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.24.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.24/mullvad-browser-windows-x86_64-15.0.24.exe
  - sha256: 85fd08c33e4cc0e0f94e92104daba5020f9bcd275d721895eddb113d84588096
Release notes: - All Platforms - Updated Firefox to 140.17.0esr - Updated NoScript to 13.6.35.1984 - Updated uBlock Origin to 1.75.0 - Bug 583: Rebase Mullvad Browser stable onto 140.17.0esr [mullvad-browser] - Bug 45366: Backport Security Fixes from Firefox 157 [tor-browser] - Bug 45368: Account for onion aliases in NoScript site parsing [tor-browser] - Bug 45371: Hook CharacterData/Range insertion sinks for content patches propagation [tor-browser] Build System - All Platforms - Bug 41847: Sign all releases using new gpg subkey [tor-browser-build] - macOS - Bug 41883: Fix sha256sum definition in projects/hfsplus-tools/config [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.24 --exact`

#### 15.0.23 — 2026-09-21

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.23.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.23/mullvad-browser-windows-x86_64-15.0.23.exe
  - sha256: 46087a4cf549a411a578e9bcc9ab8481a2084d7a9b953ce57407e011d78e73b2
Release notes: - All Platforms - Updated Firefox to 140.16.0esr - Updated NoScript to 13.6.33.1984 - Bug 577: Rebase Mullvad Browser stable onto 140.16.0esr [mullvad-browser] - Bug 45296: (H1) SharedWorker Identity Mismatch allows WebAssembly execution at Safer [tor-browser] - Bug 45297: (H1) Missing setHTMLUnsafe hook leaves a permanent WebAssembly-capable child realm at Safer [tor-browser] - Bug 45299: Backport Security Fixes from Firefox 156 [tor-browser]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.23 --exact`

#### 15.0.21 — 2026-09-03

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.21.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.21/mullvad-browser-windows-x86_64-15.0.21.exe
  - sha256: b2361d4b37ed8bf04bd7b9fed21e8e06fa35f651c7b3970f4165132ddfcc38b8
Release notes: - All Platforms - Updated Firefox to 140.15.0esr - Updated NoScript to 13.6.32.1984 - Updated uBlock Origin to 1.74.0 - Bug 572: Websites can initiate a WebSocket connection to a lan/localhost port [mullvad-browser] - Bug 45259: Backport Security Fixes from Firefox 155 [tor-browser]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.21 --exact`

#### 15.0.20 — 2026-08-18

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.20.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.20/mullvad-browser-windows-x86_64-15.0.20.exe
  - sha256: 7eb168be0eb88a5517e8a80e162d6d90205c65472604e7c634036e473b83d193
Release notes: - All Platforms - Updated Firefox to 140.14.0esr - Updated uBlock Origin to 1.73.0 - Bug 570: Rebase Mullvad Browser stable onto 140.14.0esr [mullvad-browser] - Bug 45219: Backport Security Fixes from Firefox 154 [tor-browser] Build System - All Platforms - Bug 41850: Update keyring/torbrowser.gpg for new subkey and updated expiration date of the main key [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.20 --exact`

#### 15.0.19 — 2026-07-24

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.19.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.19/mullvad-browser-windows-x86_64-15.0.19.exe
  - sha256: 1bcc69725207baaf414dbcdb7e844383bbb1b3a7e826194e563a154428db4bc7
Release notes: - All Platforms - Updated Firefox to 140.13.0esr - Updated NoScript to 13.6.31.1984 - Bug 558: Rebase Mullvad Browser stable onto 140.13.0esr [mullvad-browser] - Bug 45124: Backport Security Fixes from Firefox 153 [tor-browser] Build System - All Platforms - Bug 41838: Update personal_access_tokens URL in tools/fetch_changelogs.py [tor-browser-build] - Windows - Bug 41819: Fix windows-rs URL in projects/firefox/config [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.19 --exact`

#### 15.0.18 — 2026-07-14

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.18.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.18/mullvad-browser-windows-x86_64-15.0.18.exe
  - sha256: b45d52abf6bd5bd03388189856e7b77e712bd8424b0c973eeb63376601519839
Release notes: - All Platforms - Updated NoScript to 13.6.30.1984 - Updated uBlock Origin to 1.72.2 - Bug 45111: Cherry-pick latest firefox/esr140 commits on 140.12.0esr [tor-browser] Build System - All Platforms - Bug 41821: Update gpg subkeys for boklm [tor-browser-build] - Bug 41827: Update morgan's keychain with renewed key [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.18 --exact`

#### 15.0.16 — 2026-06-18

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.16.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.16/mullvad-browser-windows-x86_64-15.0.16.exe
  - sha256: 72f10b35a388c5f14ebff0eadc32b2a84b70f6e459f801f8fc9d8a21c398329a
Release notes: - All Platforms - Updated Firefox to 140.12.0esr - Updated NoScript to 13.6.24.1984 - Updated uBlock Origin to 1.71.0 - Bug 553: Rebase Mullvad Browser stable onto 140.12.0esr [mullvad-browser] - Bug 45044: NS 13.6.19.902 DocStartInjection regressed [tor-browser] - Bug 45054: Backport Security Fixes from Firefox 152 [tor-browser] Build System - All Platforms - Bug 41802: Remove the tor daemon requirement for signing [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.16 --exact`

#### 15.0.14 — 2026-05-19

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.14.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.14/mullvad-browser-windows-x86_64-15.0.14.exe
  - sha256: 56d5e332b1e780c6413c1a88e7b0a855ec1df5a400a26d92f08585637bc75c02
Release notes: - All Platforms - Updated Firefox to 140.11.0esr - Updated NoScript to 13.6.19.1984 - Bug 44958: Backport Security Fixes from Firefox 151 [tor-browser] Build System - All Platforms - Bug 41781: Fix clean section in rbm.local.conf.example [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.14 --exact`

#### 15.0.12 — 2026-05-07

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.12.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.12/mullvad-browser-windows-x86_64-15.0.12.exe
  - sha256: 59673dad8053e003a1980f3022a5282152bfd934f384cd62960fe442dc2aaecf
Release notes: - All Platforms - Updated Firefox to 140.10.2esr Build System - All Platforms - Bug 41781: Fix clean section in rbm.local.conf.example [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.12 --exact`

#### 15.0.11 — 2026-04-28

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.11.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.11/mullvad-browser-windows-x86_64-15.0.11.exe
  - sha256: 84a8569d104618e13e15c411912d891845f213ca0fccad2107a59efd1dc3f6f4
Release notes: - All Platforms - Updated Firefox to 140.10.1esr - Updated NoScript to 13.6.18.1984 - Bug 529: Rebase Mullvad Browser stable onto 140.10.1esr [mullvad-browser]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.11 --exact`

#### 15.0.10 — 2026-04-21

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.10.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.10/mullvad-browser-windows-x86_64-15.0.10.exe
  - sha256: f69b4d1d151390f9a5d5d11675605e2e4e68698ebcafed8ae75aba0635d3c562
Release notes: - All Platforms - Updated Firefox to 140.10.0esr - Updated Mullvad Browser Extension to 0.9.10 - Bug 525: Rebase Mullvad Browser stable onto 140.10.0esr [mullvad-browser] - Bug 44288: New identity fails to block loading a custom home page [tor-browser] - Bug 44749: Check search engines parameter replacements [tor-browser] - Bug 44859: Backport Bugzilla 1666613: Display XML error pages in the browser directionality while force LTRing the XML code itself, without the use of intl.css [tor-browser] - Bug 44863: Backport Security Fixes from Firefox 150 [tor-browser] Build System - All Platforms - Bug 41767: Add jwilde to allowed signer for browser projects [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.10 --exact`

#### 15.0.9 — 2026-04-07

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.9.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.9/mullvad-browser-windows-x86_64-15.0.9.exe
  - sha256: d4cb8f37ec52f62f824ae0d872a727241244a1b043992d7ec04638c12b46653e
Release notes: - All Platforms - Updated Firefox to 140.9.1esr - Updated NoScript to 13.6.15.1984 - Bug 524: Rebase Mullvad Browser stable onto 140.9.1esr [mullvad-browser] Build System - All Platforms - Bug 41758: Rename tools/signing/deploy-legacy to tools/signing/redeploy-update_responses-release [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.9 --exact`

#### 15.0.8 — 2026-03-25

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.8.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.8/mullvad-browser-windows-x86_64-15.0.8.exe
  - sha256: b22473520143cf98a4c6dec405fd40ffd0358b3372bccf09338ce317633b71b9
Release notes: - All Platforms - Updated Firefox to 140.9.0esr - Updated NoScript to 13.6.12.1984 - Updated uBlock Origin to 1.70.0 - Bug 521: Rebase Mullvad Browser stable onto 140.9.0esr [mullvad-browser] - Bug 44663: NoScript behavior on “Safer” security level prevents integrity checks for dynamically loaded javascript [tor-browser] - Bug 44680: Properly handle subdocuments created by data: URLs [tor-browser] - Bug 44761: Safer Level's worker patching filters out Worker constructor options [tor-browser] - Bug 44784: Backport Security Fixes from Firefox 149 [tor-browser] - Bug 41738: Allow to specify an unsupportedURL on update responses [tor-browser-build] - Linux - Bug 44657: Backport tor-browser#44394: Do not read default prefs from /etc/firefox [tor-browser]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.8 --exact`

#### 15.0.7 — 2026-02-24

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.7.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.7/mullvad-browser-windows-x86_64-15.0.7.exe
  - sha256: d87c5ccb45da22c873e98c10b03c7fae865e9b276e16365ba88a099c76b0b5cc
Release notes: - All Platforms - Updated Firefox to 140.8.0esr - Updated NoScript to 13.5.14.1984 - Bug 509: Rebase Mullvad Browser onto 140.8.0esr [mullvad-browser] - Bug 44681: Backport Security Fixes from Firefox 148 [tor-browser]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.7 --exact`

#### 15.0.6 — 2026-02-17

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.6.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.6/mullvad-browser-windows-x86_64-15.0.6.exe
  - sha256: cd102ec931b212de4b1762c491a524d2a0351a516dd15a70fb5794c4796d700b
Release notes: - All Platforms - Updated Firefox to 140.7.1esr - Updated NoScript to 13.5.13.1984 - Updated uBlock Origin to 1.69.0 - Bug 508: Rebase Mullvad Browser stable onto 140.7.1esr [mullvad-browser] - Bug 44625: metamask.io won't load on Safer security level [tor-browser] - Bug 44626: Propagate WASM blocking to workers [tor-browser] Build System - All Platforms - Bug 40338: Running make release multiple times fails [tor-browser-build] - Bug 41708: relprep.py fails to update extensions when out/browser does not exist [tor-browser-build] - Bug 41720: cp -l in release/build fails when crossing file systems [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.6 --exact`

#### 15.0.4 — 2026-01-13

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.4.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.4/mullvad-browser-windows-x86_64-15.0.4.exe
  - sha256: a18e441ecdbe356a8ca1700e71643b38f42789b9f481e844335dd882e72aef7f
Release notes: - All Platforms - Updated Firefox to 140.7.0esr - Updated NoScript to 13.5.7.1984 - Updated Mullvad Browser Extension to 0.9.7 - Bug 503: Rebase Mullvad Browser stable onto 140.7.0esr [mullvad-browser] - Bug 44433: Weird §:domain.com label in the Blocked Objects window [tor-browser] - Bug 44474: Backport Security Fixes from Firefox 147 [tor-browser] - Bug 44482: (H1) Script execution in Safest mode via data URI navigation [tor-browser] Build System - All Platforms - Bug 41682: relprep.py should fail when a GitHub release is not found [tor-browser-build] - Bug 40090: Make the cleanup faster [rbm] - Bug 40095: cached checksums should not be used for input files when refresh_input is enabled [rbm]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.4 --exact`

#### 15.0.3 — 2025-12-09

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.3.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.3/mullvad-browser-windows-x86_64-15.0.3.exe
  - sha256: 1af2ed0581bd7a371a64624229f470de250ae4dc11aeb7eaa820d99fdb10a1a8
Release notes: - All Platforms - Updated Firefox to 140.6.0esr - Updated NoScript to 13.5.2.1984 - Updated uBlock Origin to 1.68.0 - Bug 497: Rebase Mullvad Browser stable onto 140.6.0esr [mullvad-browser] - Bug 22974: Self-host NoScript Updates [tor-browser] - Bug 44348: Backport Bugzilla 1999126: Protect whether PDF.js is enabled/disabled to improve fingerprinting protection [tor-browser] - Bug 44391: Restrictions cascade blocks every capability in subframes (e.g. captchas) [tor-browser] - Bug 44409: Backport Security Fixes from Firefox 146 [tor-browser] - Bug 44414: Disable Zucchini for the 15.0 series. [tor-browser] Build System - All Platforms - Bug 493: Automatically check whether the signed build is avaliable on dist.torproject.org before notifying Mullvad for QA [mullvad-browser] - Bug 41644: Self-hosted browser extensions support in relprep.py [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.3 --exact`

#### 15.0.2 — 2025-11-20

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.2.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.2/mullvad-browser-windows-x86_64-15.0.2.exe
  - sha256: ac6bb882df0e382356cf75c1f22d5a1712459c4841e1cafe603e82223fc9a1bd
Release notes: - All Platforms - Updated Mullvad Browser Extension to 0.9.6 - Bug 486: Possible race condition for upgrade message in about:mullvad-browser [mullvad-browser] - Bug 488: Remove Leta search engine and migrate users to DuckDuckGo [mullvad-browser]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.2 --exact`

#### 15.0.1 — 2025-11-17

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.1.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0.1/mullvad-browser-windows-x86_64-15.0.1.exe
  - sha256: d02ed891c7beeffb723ae5018c7ab5b20920c068c33b8c2dfb55c62e1bc795ea
Release notes: - All Platforms - Updated Firefox to 140.5.0esr - Updated NoScript to 13.4 - Updated uBlock Origin to 1.67.0 - Bug 484: Rebase Mullvad Browser stable onto 140.5.0esr [mullvad-browser] - Bug 487: Search engines are sorted alphabetically rather than the desired order [mullvad-browser] - Bug 44275: Reduce console noise on security level guessing [tor-browser] - Bug 44310: Default zoom always resets to 100% [tor-browser] - Bug 44325: Backport Security Fixes from Firefox 145 [tor-browser] - Bug 44333: Add the "No AI" version of DuckDuckGo to available search engines [tor-browser] - Linux - Bug 44273: Restore Noto CJK as Jigmo has a too low readability [tor-browser] - Bug 44315: Font/text issue with self-upgrade window [tor-browser]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0.1 --exact`

#### 15.0 — 2025-10-30

- x64 nullsoft (user): mullvad-browser-windows-x86_64-15.0.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/15.0/mullvad-browser-windows-x86_64-15.0.exe
  - sha256: 76b1393eb845ccd4154ce2825670f2e29f7c2edaf7efd2fff3d72b4fa62924c5
Release notes: - All Platforms - Updated Firefox to 140.4.0esr - Updated NoScript to 13.2.2 - Bug 451: The restart to apply button doesn't work [mullvad-browser] - Bug 463: Fix typo in MimeType entry in .desktop file included in deb/rpm package (application/xhtml_xml instead of application/xhtml+xml) [mullvad-browser] - Bug 468: Drop the Metager search engine [mullvad-browser] - Bug 478: Update to the Mullvad Browser extension to 0.9.5 [mullvad-browser] - Bug 19741: Opensearch (contextual search) does not obey FPI [tor-browser] - Bug 42738: Tidy up the commit structure for browser updates UI [tor-browser] - Bug 43009: Backport Bug 1973265 - Put WebCodecs API behind RFP Target [tor-browser] - Bug 43093: Refactor the patch to disable LaterRun [tor-browser] - Bug 43111: Delete our webextensions for search engines when Bug 1885953 is fixed upstream [tor-browser] - Bug 43525: Check if our search engine customization still works after ESR 140 transition [tor-browser] - Bug 43590: Move letterboxing rules out of browser/base/content/browser.css [tor-browser] - Bug 43610: Use newer CSS variable names for ESR 140 [tor-browser] - Bug 43629: All migrations in migrateUIBB are run for new profiles [tor-browser] - Bug 43638: Fix up our <command> elements [tor-browser] - Bug 43664: Review Mozilla 1842832: Move the private browsing toggle to initial install dialog [tor-browser] - Bug 43728: Update search engine icon sizes [tor-browser] - Bug 43745: Disable HEVC (H265) playback support [tor-browser] - Bug 43749: Replace the newtab component and addon with our home page [tor-browser] - Bug 43770: Bugzilla 1958070: More BrowserGlue simplification/splitting [tor-browser] - Bug 43772: Do not use official branding for BB/TB/MB [tor-browser] - Bug 43776: Set branding files for l10n merging [tor-browser] - Bug 43795: Restore the URL classifier XPCOM components. [tor-browser] - Bug 43844: Security level shield icon should be flipped for RTL locales [tor-browser] - Bug 43850: Modify the Contrast Control settings for RFP [tor-browser] - Bug 43864: Remove features from the unified search button [tor-browser] - Bug 43869: Hide pens with RFP [tor-browser] - Bug 43874: Incorporate our unified extension button hiding logic into mozilla's changes for ESR 140 [tor-browser] - Bug 43886: Fix new tab for ESR 140 [tor-browser] - Bug 43900: Open newtab rather than firefoxview when unloading the last tab [tor-browser] - Bug 43902: Hide Sidebar buttons [tor-browser] - Bug 43903: Report broken site is disabled rather than hidden [tor-browser] - Bug 43905: base-browser.ftl missing from about:addons [tor-browser] - Bug 43906: Extension.sys.mjs change in the wrong commit [tor-browser] - Bug 43913: Context menu not properly populated [tor-browser] - Bug 43947: Console error from ContentBlockingPrefs.init [tor-browser] - Bug 43966: Notify the user when they are in a custom security level (desktop) [tor-browser] - Bug 43989: Switch off AI chatbot preference [tor-browser] - Bug 44030: Security Level selector does not get confirmation before restarting [tor-browser] - Bug 44034: Update string used for checkbox on New Identity confirmation dialog [tor-browser] - Bug 44040: Modify nsIPrompt and the commonDialog code to allow destructive buttons [tor-browser] - Bug 44045: Drop AI and machine learning components [tor-browser] - Bug 44090: Several of our XUL pages cause a crash because of missing CSP [tor-browser] - Bug 44106: Make sure background tasks are not used for shutdown cleanup [tor-browser] - Bug 44107: Switch tab search action is missing an icon [tor-browser] - Bug 44108: Fix the new history sidebar [tor-browser] - Bug 44123: Do not trim protocol off of URLs ever [tor-browser] - Bug 44125: Do not offer to save signatures by default in Private Browsing Mode [tor-browser] - Bug 44140: Refactored patch to prevent writing temp PDF files to disk [tor-browser] - Bug 44141: Hide "Report broken site" items by default [tor-browser] - Bug 44142: Missing document_pdf.svg from our branding directories [tor-browser] - Bug 44153: Test search engine customization [tor-browser] - Bug 44159: Change or hide the sidebar settings description [tor-browser] - Bug 44177: Remove more urlbar actions [tor-browser] - Bug 44178: Search preservation does not work with duckduckgo in safest security level [tor-browser] - Bug 44187: TLS session tickets leak Private Browsing mode [tor-browser] - Bug 44213: Reduce linkability concerns of the "Search with" contextual search action [tor-browser] - Bug 44214: Update letterboxing to reflect changes in ESR 140 [tor-browser] - Bug 44215: Hide Firefox home settings in about:preferences [tor-browser] - Bug 44221: Backport MozBug 1984333 Bump Spoofed Processor Count [tor-browser] - Bug 44234: No images in PDF [tor-browser] - Bug 44242: Hand over Security Level's WebAssembly controls to NoScript [tor-browser] - Bug 44262: Disable adding search engines from HTML forms [tor-browser] - Bug 44270: Match Firefox's TLS fingerprint [tor-browser] - Bug 44275: Reduce console noise on security level guess [tor-browser] - Bug 44279: Disable contextual search install prompt [tor-browser] - Windows - Bug 440: Make abseil use win32 thread model on mingw [mullvad-browser] - Bug 44046: Replace BASE_BROWSER_UPDATE with BASE_BROWSER_VERSION in the font visibility list [tor-browser] - Bug 44062: Force touch enabled on Windows and Android [tor-browser] - Linux - Bug 43950: Review Mozilla 1894818: Support HEVC playback on Linux [tor-browser] - Bug 43959: Make Noto Color Emoji the default emoji font on Linux [tor-browser] - Bug 44227: Some CJK characters cannot be rendered by Tor which uses the Noto font family [tor-browser] - Bug 44286: Hardcode GTK system font [tor-browser] - Bug 41586: Replace Noto CJK with Jigmo on Linux [tor-browser-build] Build System - All Platforms - Bug 466: Automate the release process / replace the new build email [mullvad-browser] - Bug 43891: Update the translation CI to use the new mozilla versions [tor-browser] - Bug 44067: Move --enable-geckodriver only to Linux-only mozconfigs [tor-browser] - Bug 44103: git's export-subst is a reproducibility problem [tor-browser] - Bug 44104: Don't run linter when there are no overall changes [tor-browser] - Bug 26408: Make MAR signature checks clearer when creating incremental MAR files [tor-browser-build] - Bug 34434: Remove unused variables from rbm.conf [tor-browser-build] - Bug 40697: Delete repackage_browser.sh [tor-browser-build] - Bug 40698: Update locale in tbb_version.json [tor-browser-build] - Bug 40994: Add support in do-all-signing to sign release for some archs only [tor-browser-build] - Bug 41064: Update tools/signing/README and add a tools/signing/machines-setup/README [tor-browser-build] - Bug 41227: Update projects/common/list_toolchain_updates-common-firefox-geckoview to include check for binutils [tor-browser-build] - Bug 41373: Remove _ALL from mar filenames [tor-browser-build] - Bug 41444: Build artifacts to support artifact builds of Tor/Muillvad/Base Browser [tor-browser-build] - Bug 41448: Update toolchains for Firefox ESR 140 [tor-browser-build] - Bug 41452: Skip update-responses xml files for versions which don't have incrementals [tor-browser-build] - Bug 41457: Set mar IDs as env variables in tor-browser-build [tor-browser-build] - Bug 41459: Update taskcluster/ci paths in README and comments [tor-browser-build] - Bug 41465: Disable development artifacts generation by default, keep it enabled for nightly builds [tor-browser-build] - Bug 41478: Add vim and others missing basic tools to base container image [tor-browser-build] - Bug 41496: Clean up unused projects [tor-browser-build] - Bug 41501: cargo_vendor generated archive maintains timestamps [tor-browser-build] - Bug 41517: Add morgan's key to the setup account on the signing machine [tor-browser-build] - Bug 41534: Copy geckodriver only for Linux x86-64 [tor-browser-build] - Bug 41539: Update Ubuntu version used to run mmdebstrap to 24.04.3 [tor-browser-build] - Bug 41568: Update instructions for manually building 7zip [tor-browser-build] - Bug 41579: Add zip to the list of Tor Browser Build dependencies [tor-browser-build] - Bug 40084: Always use bash for the debug terminal [rbm] - Bug 40087: Downloaded files getting stricter permissions than expected [rbm] - Windows - Bug 44167: Move the nsis-uninstall.patch to tor-browser repository [tor-browser] - macOS - Bug 41503: Error 403 when downloading macOS SDK [tor-browser-build] - Bug 41527: Update libdmg-hfsplus and enable LZMA compression on dmgs [tor-browser-build] - Bug 41538: Bump macOS SDK to 15.5 [tor-browser-build] - Bug 41571: Work-around to prevent older 7z versions to break rcodesign. [tor-browser-build] - Linux - Bug 41458: Ship geckodriver only on Linux [tor-browser-build] - Bug 41488: Disable sys/random.h for Node.js [tor-browser-build] - Bug 41558: Share descriptions between Linux packages and archives [tor-browser-build] - Bug 41561: Ship Noto Color Emoji on Linux [tor-browser-build] - Bug 41569: Use var/display_name in .desktop files [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 15.0 --exact`

#### 14.5.8 — 2025-10-15

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.5.8.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.5.8/mullvad-browser-windows-x86_64-14.5.8.exe
  - sha256: 847d70912cc0875df0b189ec6e0de6d328797eb116390d4d7573889872d9afaf
Release notes: All Platforms - Updated NoScript to 13.2.1 - Updated Mullvad Browser Extension to 0.9.5 - Updated uBlock Origin to 1.66.4 - Bug 44239: DDG HTML page and search results displayed incorrectly with Safest security setting [tor-browser] - Bug 44240: Typo on dom.security.https_first_add_exception_on_failure [tor-browser] - Bug 44244: Backport Security Fixes from Firefox 144 [tor-browser]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.5.8 --exact`

#### 14.5.7 — 2025-09-16

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.5.7.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.5.7/mullvad-browser-windows-x86_64-14.5.7.exe
  - sha256: 8e0bb947caf332a150511b78ff82d05ad5dd4dec8677fa1837a26f6558f017c8
Release notes: All Platforms - Updated uBlock Origin to 1.66.0 - Bug 44199: Backport Security Fixes from Firefox 143 [tor-browser] - Bug 41462: Backport #40994 and #41280: Add support in signing scripts to sign release for some archs only & Update download-android-*.json files for android-only releases [tor-browser-build] - Bug 41543: mmdebstrap-image fails to build bookworm images on maint-14.5 [tor-browser-build] Build System Linux - Bug 41560: Backport mullvad-browser#463: Fix typo in MimeType entry in .desktop file included in deb/rpm package [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.5.7 --exact`

#### 14.5.6 — 2025-08-21

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.5.6.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.5.6/mullvad-browser-windows-x86_64-14.5.6.exe
  - sha256: c5b99ad8e73a06cfc35cf7e2f4658f2c0ec17f3600b5d58fe7efcb0dc94e1513
Release notes: All Platforms - Updated Firefox to 128.14.0esr - Updated NoScript to 13.0.9 - Bug 459: Rebase Mullvad Browser onto 128.14.0esr [mullvad-browser] - Bug 44041: Letterboxing causes greyed out alert background to be mis-aligned [tor-browser] - Bug 44048: Backport Bug 1979608 [tor-browser] - Bug 44100: Backport Security Fixes from Firefox 142 [tor-browser] Build System All Platforms - Bug 41529: Automate publishing browser release branch and tags to Mullvad repository [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.5.6 --exact`

#### 14.5.5 — 2025-07-24

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.5.5.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.5.5/mullvad-browser-windows-x86_64-14.5.5.exe
  - sha256: 96c2b66287a524eac831d6cbd8bcbca314344fb2afe32979dae130a7ea5f3afc
Release notes: All Platforms - Updated Firefox to 128.13.0esr - Updated uBlock Origin to 1.65.0 - Bug 453: Rebase Mulvad Browser Stable onto 128.13.0esr [mullvad-browser] - Bug 43993: Backport Security Fixes from Firefox 141 [tor-browser]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.5.5 --exact`

#### 14.5.4 — 2025-06-25

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.5.4.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.5.4/mullvad-browser-windows-x86_64-14.5.4.exe
  - sha256: a451942a519d0b89ec990489ccc2900eabc3f9c50d37ee27b4640dd74ba38e28
Release notes: All Platforms - Updated Firefox to 128.12.0esr - Updated NoScript to 13.0.8 - Bug 450: Rebase Mullvad Browser stable onto 128.12.0esr [mullvad-browser] - Bug 43782: Add new UX flow for changing security level (Desktop) [tor-browser] - Bug 43783: Tighten up the SecurityLevel module to enforce new UX flow [tor-browser] - Bug 43784: Get confirmation from NoScript that settings are applied [tor-browser] - Bug 43911: Backport security fixes from Firefox 140 [tor-browser] Build System All Platforms - Bug 41477: Update keyring/boklm.gpg for new subkeys (2025) [tor-browser-build] - Bug 41498: Update keyring/morgan.gpg with updated public key [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.5.4 --exact`

#### 14.5.3 — 2025-06-02

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.5.3.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.5.3/mullvad-browser-windows-x86_64-14.5.3.exe
  - sha256: d0c64a7588c28474281173ffcf02e556a3294cdfe3a31a90b38663718d9785cd
Release notes: All Platforms - Updated Firefox to 128.11.0esr - Updated NoScript to 13.0.6 - Bug 439: Rebase Mullvad Browser stable onto 128.11.0esr [mullvad-browser] - Bug 43811: Backport security fixes from Firefox 139 [tor-browser]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.5.3 --exact`

#### 14.5.2 — 2025-05-19

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.5.2.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.5.2/mullvad-browser-windows-x86_64-14.5.2.exe
  - sha256: f26eee6a9de362d04d8fc52595d66d0a037d938827745e0b39e93fcd12fe3504
Release notes: All Platforms - Updated Firefox to 128.10.1esr- - Updated NoScript to 12.6 - Updated uBlock Origin to 1.64.0 - Bug 438: Rebase Mullvad Browser stable onto 128.10.1 [mullvad-browser] - Bug 43397: Click to play should override "Any capability blocked in the top document must be blocked in its subdocuments too" [tor-browser] - Bug 43635: Console noise due to the x-load capability not being localized [tor-browser] - Bug 43738: Backport Bugzilla 1947157: Move linux security warning content into own page [tor-browser] - Bug 41460: Add brizental to the list of people who can sign Tor Browser and Mullvad Browser tags [tor-browser-build] Build System All Platforms - Bug 43777: Disable ./mach telemetry [tor-browser] - Bug 41449: Add prefix to update-responses xml files [tor-browser-build] - Bug 41451: When update-responses contains multiple versions, .htaccess only has one no-update.xml redirect [tor-browser-build] - Bug 41452: Skip update-responses xml files for versions which don't have incrementals [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.5.2 --exact`

#### 14.5.1 — 2025-04-30

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.5.1.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.5.1/mullvad-browser-windows-x86_64-14.5.1.exe
  - sha256: 0fd78fba5cb4e987d14bb3aef773b5346eeb1817a60e0bac58051d45820b7836
Release notes: All Platforms - Updated Firefox to 128.10.0esr - Bug 421: Rebase Mullvad Browser release onto 128.10.0esr [mullvad-browser] - Bug 43659: Set new tabs to default to Tor Browser Home (about:tor) on desktop [tor-browser] - Bug 43672: Incorrect initial letterbox size when the interface font size is 13px. [tor-browser] - Bug 43691: Backport security fixes from Firefox 138 [tor-browser] Build System All Platforms - Bug 41435: Skip update-responses update entries for versions without incremental or full update mar [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.5.1 --exact`

#### 14.5 — 2025-04-22

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.5.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.5/mullvad-browser-windows-x86_64-14.5.exe
  - sha256: 05aaaf8c8164ee65d665ec29666d2a8fa6966dd14a17c598b08c4912d58cf5a0
Release notes: All Platforms - Bug 312: Apply Alpha and Nightly branding to unstable release channels [mullvad-browser] - Bug 324: Figure out how to handle string differences between mullvad release and mullvad tip [mullvad-browser] - Bug 410: Update learn more link text in about:mullvad-browser [mullvad-browser] - Bug 411: Use the same logic in about:mullvad-browser as the about dialog for the release notes [mullvad-browser] - Bug 412: Link the release page in the about dialog and clean brand-related preferences [mullvad-browser] - Bug 419: Create a Mullvad Browser version of migrateUI [mullvad-browser] - Bug 41051: Replace Noto Sans Myanmar with Pyidaungsu [tor-browser] - Bug 41755: Show the link to about:support in the help menu [tor-browser] - Bug 41919: Add temporarily visible web content-size overlay after resizing window when letterboxing is enabled [tor-browser] - Bug 42670: Letterboxing visible even if disable with tiled window managers [tor-browser] - Bug 42739: Fix localization in the profile error dialog [tor-browser] - Bug 43189: Remove privacy.resistFingerprinting.spoofOsInUserAgentHeader machinery entirely [tor-browser] - Bug 43205: newwin / letterboxing rounding with subpixels is off [tor-browser] - Bug 43257: NoScript-blocked content placeholders causing slow downs [tor-browser] - Bug 43323: Expose a stable asset from chrome:// to identify Tor, Base, and Mullvad Browser [tor-browser] - Bug 43334: Developer Tools lacks data for Responsive Design Mode and Compatibility [tor-browser] - Bug 43340: Support linux-aarch64 dev builds [tor-browser] - Bug 43551: Backport Mozilla Bug 1924070 - modify H.264 extradata to match sample conversion code. [tor-browser] - Bug 43632: Letterboxing size indicator may display data from a background tab [tor-browser] - Bug 43642: New tab shows letterboxing size indicator [tor-browser] - Bug 43653: privacy.resistFingerprinting.spoofOsInUserAgentHeader is still in our pref file even though we ripped out the code [tor-browser] Windows - Bug 43402: set browser.startup.blankWindow false [tor-browser] Linux - Bug 415: Load apparmor profile when configuring deb package [mullvad-browser] - Bug 30970: Different window borders in XFCE can lead to different, not rounded window sizes [tor-browser] - Bug 41799: Make lack of fonts.conf less of a footgun [tor-browser] - Bug 43140: Ship our FontConfig configuration with the browser [tor-browser] - Bug 43330: System fonts leak when emptying the allow list on Linux [tor-browser] - Bug 41297: Add video codecs dependencies (recommends) on the Debian package [tor-browser-build] - Bug 41298: Remove --detach parameter from .desktop files [tor-browser-build] - Bug 41312: Remove comment in start-browser about --class and --name parameters [tor-browser-build] Build System All Platforms - Bug 43295: Update MR templates [tor-browser] - Bug 43373: Do not run all CI jobs for scheduled jobs. [tor-browser] - Bug 40799: Remove legacy locale iteration in build and signing scripts [tor-browser-build] - Bug 41040: Add configuration to rbm.conf to select channel and platforms [tor-browser-build] - Bug 41281: Better dev defaults for fetch variable [tor-browser-build] - Bug 41288: Avoid unneeded git checkouts when possible [tor-browser-build] - Bug 41304: Add a browser commit tag+signing script [tor-browser-build] - Bug 41306: Container dependencies are sorted before resolving templates [tor-browser-build] - Bug 41307: Container dependencies are not filtered for duplicates [tor-browser-build] - Bug 41315: Fix the Mullvad Extension update in relprep.py [tor-browser-build] - Bug 41358: Update sign-tag script to handle rapid-release nightly branches [tor-browser-build] - Bug 41363: Change update-response generation script to create one commit per OS+arch tuple [tor-browser-build] - Bug 41365: Indent download*.json files [tor-browser-build] - Bug 41374: Remove support for migrate_archs and migrate_langs in update_responses [tor-browser-build] - Bug 41381: Usability improvements for the browser commit tagging script [tor-browser-build] - Bug 41382: Replace gitlab templates ReleasePrep label references with AppsTypeReleasePreparation [tor-browser-build] - Bug 41389: Remove need to update set-config.tbb-version [tor-browser-build] - Bug 41394: Fix upload-update_responses-to-staticiforme for mullvadbrowser [tor-browser-build] - Bug 41401: Replace Noto Sans Myanmar with Pyidaungsu [tor-browser-build] - Bug 41409: Create a script for quickly setting up protected branches [tor-browser-build] - Bug 41419: Add comment in downloads.json to mention that the file is deprecated, and that download-$platform.json should be used instead [tor-browser-build] - Bug 40006: Add option to avoid doing a git checkout when using the exec template function [rbm] - Bug 40079: Make fetch: if_needed fetch existing branches [rbm] - Bug 40081: Support apt option for not installing recommended dependencies [rbm] - Bug 40082: With fetch: if_needed, rbm is doing a git fetch when it shouldn't, when using a fixed commit [rbm] - Bug 40083: rbm creates out/$project directories with mode 0700 [rbm] Windows + macOS - Bug 41349: Wrong copyright year makes build non-reproducible [tor-browser-build] macOS - Bug 41403: The rcodesign step has a wrong dmg name in alpha [tor-browser-build] Linux - Bug 41266: Build the Tor and Mullvad Browsers for aarch64 Linux [tor-browser-build] - Bug 41329: Do not install python2.7-minimal in the linux-aarch64 firefox container [tor-browser-build] - Bug 41331: Make update_responses find linux-aarch64 mar files [tor-browser-build] - Bug 41335: linux-package project is not getting the channel target in testbuilds [tor-browser-build] - Bug 41397: Building mullvad-browser no longer generates .deb or .rpm packages [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.5 --exact`

#### 14.0.9 — 2025-04-01

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.0.9.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.0.9/mullvad-browser-windows-x86_64-14.0.9.exe
  - sha256: 4d59d483a4890ea91bf2be9c10a65168f5b55cf55b23f86505f9618e16d1bcb1
Release notes: All Platforms - Updated Firefox to 128.9.0esr - Updated uBlock Origin to 1.63.2 - Bug 416: Rebase Mullvad Browser stable onto 128.9.0esr [mullvad-browser] - Bug 43601: Backport security fixes from Firefox 137 [tor-browser] macOS + Linux - Bug 404: Incorrect information in about:rights [mullvad-browser] #Build System All Platforms - Bug 41420: Update the changelog script for label updates [tor-browser-build] macOS + Linux - Bug 41375: Backport Bug 41374+40799: Remove support for migrate_archs and migrate_langs in update_responses + Remove legacy locale iteration in update-responses and dmg2mar [tor-browser-build] - Bug 41378: Backport Bug 41363: Make separate update_responses commit for each platform [tor-browser-build] - Bug 41383: Add clairehurst to list of accepted firefox/geckoview signers [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.0.9 --exact`

#### 14.0.8 — 2025-03-27

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.0.8.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.0.8/mullvad-browser-windows-x86_64-14.0.8.exe
  - sha256: 6ccb40eb83720cc5a77edad794375f4ccb4b2b796b11ae564e3c7d5e8b79c016
Release notes: This is a emergency security release for Windows. Windows - Bug 404: Incorrect information in about:rights [mullvad-browser] - Bug 43592: Backport security fixes from Firefox 128.8.1esr [tor-browser] Build System Windows - Bug 41375: Backport Bug 41374+40799: Remove support for migrate_archs and migrate_langs in update_responses + Remove legacy locale iteration in update-responses and dmg2mar [tor-browser-build] - Bug 41378: Backport Bug 41363: Make separate update_responses commit for each platform [tor-browser-build] - Bug 41383: Add clairehurst to list of accepted firefox/geckoview signers [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.0.8 --exact`

#### 14.0.7 — 2025-03-04

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.0.7.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.0.7/mullvad-browser-windows-x86_64-14.0.7.exe
  - sha256: 9cf3fc0971e30d6b5c4f31346960e99b8a97bc3afbde3f2823eb917e8d5cdb24
Release notes: All Platforms - Updated Firefox to 128.8.0esr - Bug 395: Set Mullvad Leta as default search engine [mullvad-browser] - Bug 398: Rebase Mullvad Browser release onto Firefox 128.8.0esr [mullvad-browser] - Bug 403: Backport Bugzilla 1915093: Don't prefetch HTTPS RR if proxyDNS is enabled [mullvad-browser] - Bug 43536: Backport security fixes from Firefox 136 [tor-browser] macOS - Bug 43468: ScreenCaptureKit framework should be a weak link [tor-browser] Linux - Bug 394: Missing package when try to install Mullvad Browser in Debian Trixie [mullvad-browser] Build System All Platforms - Bug 41380: Update kick-devmole script to use Mullvad's new GitHub action [tor-browser-build] Linux - Bug 41385: Copy only libstdc++.so.6 on Linux [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.0.7 --exact`

#### 14.0.4 — 2025-01-09

- x64 nullsoft (user): mullvad-browser-windows-x86_64-14.0.4.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.0.4/mullvad-browser-windows-x86_64-14.0.4.exe
  - sha256: e958cbfbe040a619f0cc34f5ff84a634dc8a8ffd25bf7baee027e019a40ce074
- x86 nullsoft (user): mullvad-browser-windows-x86_64-14.0.4.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.0.4/mullvad-browser-windows-x86_64-14.0.4.exe
  - sha256: e958cbfbe040a619f0cc34f5ff84a634dc8a8ffd25bf7baee027e019a40ce074
Release notes: All Platforms - Updated Firefox to 128.6.0esr - Updated NoScript to 12.1.1 - Updated uBlock Origin to 1.61.2 - Bug 359: Remove 13.5 mullvad-browser fluent files from translation [mullvad-browser] - Bug 388: Rebase Mullvad Browser stable onto Firefox 128.6.0esr [mullvad-browser] - Bug 42125: lock RFP part 2 [tor-browser] - Bug 43176: noscript-marker CSP warnings in the console [tor-browser] - Bug 43269: NoScript localization issue [tor-browser] - Bug 43282: Unable to click/tap/select anything adjacent the WebGL placeholders [tor-browser] - Bug 43296: NoScript-blocked video content placeholder is not centered [tor-browser] - Bug 43338: Custom zoom + "Zoom text only" breaks pdfjs [tor-browser] - Bug 43352: Failing connection attempts to multicast IPv6 ff00:::443 logged during NoScript updates [tor-browser] - Bug 43366: Do not use system accent color in inputs [tor-browser] - Bug 43384: Backport security fixes from Firefox 134 [tor-browser] Linux - Bug 41311: AppArmor profile fails on Debian stable [tor-browser-build] - Bug 41313: Show waiting cursor while app opens [tor-browser-build] Build System All Platforms - Bug 41321: Update PieroV's expired keys [tor-browser-build] - Bug 41340: Update kick_devmole_build script with Mullvad's new GitHub workflow endpoint [tor-browser-build] macOS - Bug 41325: Newer versions of 7z fail to extract our dmg files because of the /Applications symlink [tor-browser-build] - Bug 41327: Print more logs when make_full_update.sh failed to generate mar file in dmg2mar [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.0.4 --exact`

#### 14.0.3

- x64 nullsoft: mullvad-browser-windows-x86_64-14.0.3.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.0.3/mullvad-browser-windows-x86_64-14.0.3.exe
  - sha256: 049d819bd6f00a2791dbe605a7fe981bdbd545491ecd3bba7a7259b525c1deff

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.0.3 --exact`

#### 14.0

- x64 nullsoft: mullvad-browser-windows-x86_64-14.0.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/14.0/mullvad-browser-windows-x86_64-14.0.exe
  - sha256: f8f6cdd9e201eaa85717ed71008756b4e6f5c67128db43647da7b48b028fb981

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 14.0 --exact`

#### 13.5.7

- x64 nullsoft: mullvad-browser-windows-x86_64-13.5.7.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/13.5.7/mullvad-browser-windows-x86_64-13.5.7.exe
  - sha256: 755a5cbe4c9a6f21181fe6f16f5be8b24e3ad6d9ce4e635ce2b6dea28e0d03f8

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 13.5.7 --exact`

#### 13.5.6

- x64 nullsoft: mullvad-browser-windows-x86_64-13.5.6.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/13.5.6/mullvad-browser-windows-x86_64-13.5.6.exe
  - sha256: b7b900f5abd4118298523cfd5a639d071808399bbf87c2c5f31baad422676837

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 13.5.6 --exact`

#### 13.5.1 — 2024-07-10

- x64 nullsoft: mullvad-browser-windows-x86_64-13.5.1.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/13.5.1/mullvad-browser-windows-x86_64-13.5.1.exe
  - sha256: 205a25c0a5a562e5e4c3809f65186f9bdba449dff5e684a79c7fefc7386df23f
Release notes: https://github.com/mullvad/mullvad-browser/releases/tag/13.5.1

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 13.5.1 --exact`

#### 13.0.14 — 2024-04-12

- x64 nullsoft: mullvad-browser-windows-x86_64-portable-13.0.14.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/13.0.14/mullvad-browser-windows-x86_64-portable-13.0.14.exe
  - sha256: 948cc1ded05eed59a443ed5a52ca1c3a10688fc7b68df5bd91b9e5202995a917
Release notes: All Platforms - Updated Firefox to 115.10.0esr - Updated uBlock Origin to 1.57.2 - After update, don't open the release page on Github. Instead link it in the startpage, like in Tor Browser [mullvad-browser] - New identity complains about about:mullvad-browser [mullvad-browser] - Rebase Mullvad Browser stable onto 115.10.0esr [mullvad-browser] - Set privacy.resistFingerprinting.testing.setTZtoUTC as a defense-in-depth [tor-browser] - Let users decide whether to load their home page on new identity. [tor-browser] - Do not localize the order of locales for app lang [tor-browser] - Timezone offset leak via document.lastModified [tor-browser] - App languages not sorted correctly in stable [tor-browser] - Timezone May leak from XSLT Date function [tor-browser] Linux - Avoid Fontconfig warning about "ambiguous path" [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 13.0.14 --exact`

#### 13.0.13 — 2024-03-22

- x64 nullsoft: mullvad-browser-windows-x86_64-portable-13.0.13.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/13.0.13/mullvad-browser-windows-x86_64-portable-13.0.13.exe
  - sha256: 26909cee72669c71ae8f93d5a8bb8cb50f4989a414df84045fa8a9ce476a2a02
Release notes: All Platforms - Updated Firefox to 115.9.1esr - ESR 115.9.1 fixes [tor-browser] - Rebase Mullvad Browser stable onto Firefox 115.9.1esr [mullvad-browser]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 13.0.13 --exact`

#### 13.0.12 — 2024-03-18

- x64 nullsoft: mullvad-browser-windows-x86_64-portable-13.0.12.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/13.0.12/mullvad-browser-windows-x86_64-portable-13.0.12.exe
  - sha256: ffa2056e180393ef6b7985adc2f82463769b20d8754c0b6aba5904fbe10fe8ff
Release notes: All Platforms - Updated Firefox to 115.9.0esr - Updated mullvad-browser-extension to 0.9.0 - Updated uBlock Origin to 1.56.0 - Mullvad support email has changed from support@mullvad.net to support@mullvadvpn.net [mullvad-browser] - Rebase Mullvad Browser stable onto Firefox 115.9.0esr [mullvad-browser] - The placeholder of datetime inputs keeps being localized when spoof English is on [tor-browser] - spoof english + htmlform <details> can leak app language [tor-browser] Windows - Hidden fonts are automatically added to the allow list [tor-browser] Build System All Platforms - kick_devmole_build script prints wrong URL for Mullvad's build hashes [tor-browser-build] - authenticode-timestamping.sh fails to run again because tmp-timestamp already exists [tor-browser-build] - src archive does not match likely due to mismatched xz-utils version [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 13.0.12 --exact`

#### 13.0.10 — 2024-02-16

- x64 nullsoft: mullvad-browser-windows-x86_64-portable-13.0.10.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/13.0.10/mullvad-browser-windows-x86_64-portable-13.0.10.exe
  - sha256: 2b20d948e11631107cc418945adb0788d5fcdb4550d92546256405caface9dd3
Release notes: All platforms - Updated Firefox to 115.8.0esr - Updated mullvad-browser-extension to 0.8.5 - Rebase Mullvad Browser Stable onto Firefox 115.8.0esr [mullvad-browser] - Spoof english leaks via numberingSystem: numbers (non-latn) or decimal separator (latn) [tor-browser] Build System All Platforms - Set time on signing machine before starting signing [tor-browser-build] - Use Capture::Tiny instead of IO::CaptureOutput [tor-browser-build] - Switch from IO::CaptureOutput to Capture::Tiny [rbm] - Make stdout and stderr utf8 [rbm]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 13.0.10 --exact`

#### 13.0.9 — 2024-01-23

- x64 nullsoft: mullvad-browser-windows-x86_64-portable-13.0.9.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/13.0.9/mullvad-browser-windows-x86_64-portable-13.0.9.exe
  - sha256: 25dcefa14404f2bdc925d8dbfa5f2fc81f78129e0fa714a88832e16255a0d46b
Release notes: All platforms - Updated Firefox to 115.7.0esr - Updated uBlock Origin to 1.55.0 - Bug 249: BrowserHost has null mRoot when applying initial window size in debug - Bug 260: Rebase Mullvad Browser Stable onto Firefox 115.7.0esr - Bug 42189: Assertion failure: the value of mPrivateBrowsingId in the loadContext and in the loadInfo are not the same! - Bug 41044: Add tbb_version.json-like file for Mullvad Browser Linux - Bug 41050: Improve the disk leak sanitization on start-$browser All Platforms - Bug 41042: Add options to include updates in the changelog - Bug 41043: Create script to push build requests to Mullvad build servers - Bug 41056: Make it possible to use templates in var/torbrowser_incremental_from - Bug 41059: Update keyring/torbrowser.gpg with updated key Windows + macOS - Bug 41016: Switch from bullseye to bookworm for desktop platforms Windows - Bug 41015: Enable std::filesystem on libc++ on Windows

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 13.0.9 --exact`

#### 13.0.7 — 2023-12-14

- x64 nullsoft: mullvad-browser-windows-x86_64-portable-13.0.7.exe
  - url: https://github.com/mullvad/mullvad-browser/releases/download/13.0.7/mullvad-browser-windows-x86_64-portable-13.0.7.exe
  - sha256: 7b2c423876cbd8068e5d47587a3138662f91fe2a4353533b15788584f7733023
Release notes: All Platforms Updated Firefox to 115.6.0esr - Bug 42042: view-source:http://ip-address does not work because of HTTPS Only [tor-browser] Build System All Platforms - Bug 40884: Script to automate uploading sha256s and signatures to location signing/download-unsigned-sha256sums-gpg-signatures-from-people-tpo expects them to be [tor-browser-build] - Bug 41026: Do not use ~ when uploading the signed hashes [tor-browser-build] - Bug 41039: Update tools/signing/upload-update_responses-to-staticiforme to keep download-*json files from previous release when new release does not include them [tor-browser-build] macOS - Bug 40990: Remove old macos signing scripts [tor-browser-build]

Pin: `winget install --id MullvadVPN.MullvadBrowser --version 13.0.7 --exact`

## macOS

### What the installer does
- Delivered as a disk image (.dmg) for Apple silicon and Intel.
- Installs the app `Mullvad Browser.app` into the Applications folder.
- The app updates itself, so it may be newer than the version Homebrew lists.
- On uninstall, Homebrew asks the app to quit.
- A full “zap” removal also deletes up to 4 support, cache and preference locations in your home folder.

### Versions (newest first) — Homebrew lists only the current release

#### 16.0

- universal dmg: mullvad-browser-macos-16.0.dmg
  - url: https://cdn.mullvad.net/browser/16.0/mullvad-browser-macos-16.0.dmg
  - sha256: 41082f0d00db8107d4c171f2c5ec388f794ab2177a1a811b7ec880c319681cfb

Install: `brew install --cask mullvad-browser`

## Linux

### What the installer does
- Delivered as a "flatpak" installer for x64 and ARM64.
- The manifest does not state an install scope.
- No silent-install switch is declared in the manifest.

### Versions (newest first) — Flathub lists only the current release

#### 16.0 — 2026-10-28

- x64 flatpak: net.mullvad.MullvadBrowser.flatpakref
  - url: https://dl.flathub.org/repo/appstream/net.mullvad.MullvadBrowser.flatpakref
  - sha256: not provided by upstream
- arm64 flatpak: net.mullvad.MullvadBrowser.flatpakref
  - url: https://dl.flathub.org/repo/appstream/net.mullvad.MullvadBrowser.flatpakref
  - sha256: not provided by upstream

Install: `flatpak install flathub net.mullvad.MullvadBrowser`