Browser Privacy Ranking 2026: Tor Browser Leads at 9.5 While Chrome and Yandex Rank Lowest
SecurityLab.ru has released its 2026 browser privacy ranking that measures real behavior rather than marketing claims. The evaluation uses six criteria: network activity immediately after installation, cross-site state isolation, resistance to browser fingerprinting, funding model, depth of configurability, and code verifiability together with the fate of content blockers.
Tor Browser 15.0 tops the list with a score of 9.5. It unifies the fingerprint, letterboxes the window, and applies JavaScript protections at multiple security levels while routing traffic through the Tor network. The 15.0 release, based on Firefox ESR 140, removed AI features and added a non-AI DuckDuckGo option.
Mullvad Browser 15.0 follows at 9.0 with the same anti-fingerprinting engine but without the Tor network, offering constant private mode and zero telemetry. LibreWolf 153.0 scores 8.5 by stripping Mozilla telemetry, pre-installing uBlock Origin, and enabling fingerprint resistance by default.
Brave 1.93 receives 7.5 for its Shields system that blocks ads and trackers at the engine level, bypassing Manifest V3 restrictions. However, it ships with P3A telemetry enabled and includes cryptocurrency features that must be disabled manually. Ungoogled Chromium 150.0 scores 7.0 for sending zero requests to Google services yet ships without any built-in ad or tracker blocking.
DuckDuckGo Browser 1.202 earns 6.5 for immediate tracker protection but still allows requests to bat.bing.com under a Microsoft syndication agreement. Safari 26.5 and Firefox 153.0 both score 6.0 out of the box; Firefox can reach 8.5 after about an hour of about:config tuning and container extensions.
Lower scores go to Vivaldi 8.1 (4.5) for its daily unique profile identifier, Microsoft Edge 151.0 (3.0) for extensive Microsoft telemetry and Copilot integration, Google Chrome 151.0 (2.5) for sending every address-bar character to Google and abandoning third-party cookie changes, Opera 134.0 (2.0) for sending visited URLs to sitecheck.opera.com, and Yandex Browser (1.5) for hardware identifiers and deep ecosystem integration.
The report also covers the Local Mess technique disclosed in June 2025 that allowed Meta Pixel and Yandex Metrika scripts to exfiltrate cookies via localhost connections to mobile apps, bypassing all browser isolation mechanisms including incognito mode.
Related articles
Why Replace Proprietary BIOS and UEFI with the Fully Free GNU Boot Firmware
The Free Software Foundation announced in September 2026 that it is providing financial and legal support to the GNU Boot project, which aims to deliver a completely open-source replacement for traditional BIOS and UEFI firmware. GNU Boot builds on coreboot to initialize hardware at boot time and layers a free bootloader such as GRUB or SeaBIOS on top, ensuring no proprietary binary blobs are required. The initiative emerged after a 2022 split from Libreboot, which began accepting closed-source components to broaden hardware support, while GNU Boot strictly adheres to GNU licensing criteria that prohibit any non-free code. Supported platforms remain limited to older systems from roughly 2008–2012, including specific ThinkPad models, certain early Apple MacBooks, and a handful of AMD and Intel desktop boards, because newer Intel Boot Guard and AMD equivalent mechanisms enforce signed firmware that prevents unsigned replacements. Closed firmware from Intel Management Engine and AMD Platform Security Processor runs before the main operating system, possesses unrestricted memory access, and cannot be audited or disabled on most modern hardware. By offering reproducible builds and clearer installation instructions, GNU Boot seeks to lower the barrier for users who want to eliminate potential backdoors, Wi-Fi whitelist restrictions, and forced updates found in vendor firmware.
WhatsApp Help Pages Hid Secret Instructions Directing AI Bot to Avoid GDPR References
Researchers at Redact discovered hidden instructions embedded in WhatsApp's public help documentation that instructed the company's AI support chatbot to avoid recommending users contact data protection regulators. The instructions also prohibited the bot from referencing GDPR, LGPD, or CCPA when users mentioned legal proceedings or lawyers. The findings emerged after Redact analyzed 545 help pages and identified 102 concealed blocks across 80 of them. One directive explicitly told the bot not to suggest contacting supervisory authorities even when users had lost access to their phone number and could not delete their account, despite WhatsApp's own European privacy policy stating that such complaints are permitted. WhatsApp confirmed to WIRED that the blocks were intended solely for its internal chatbot and attributed their public exposure to an error. The company stated the restrictions aimed to prevent the bot from offering legal advice. All hidden blocks were removed by October 18.
WhatsApp Secretly Instructed AI Support Bot to Suppress References to Data Regulators and Privacy Laws
Investigators discovered hidden instructions embedded in WhatsApp's public help pages that directed the company's AI chatbot to avoid recommending users contact data protection authorities. The instructions also prohibited the AI from citing privacy regulations such as GDPR, LGPD, or CCPA, even when users raised these topics themselves. The directives appeared on pages about account deletion and complaints, remaining invisible to human visitors but delivered to crawlers and the AI model. WhatsApp later confirmed the text was intended for its internal support chatbot and attributed the exposure to an error that has since been corrected. The findings highlight a gap between the company's publicly stated privacy policy and the operational guidance given to its AI systems.
Developer Builds Password Manager with Plausible Deniability Using Argon2id and XChaCha20-Poly1305
A Java backend developer rewrote a personal password manager originally built with Electron and React, migrating it to Tauri and Rust while redesigning its storage to support plausible deniability. The new implementation derives keys with Argon2id using a single per-install salt and encrypts files with XChaCha20-Poly1305, storing only random 32-character hex filenames without any headers or magic bytes. Multiple decoy vaults of identical size are created automatically for every user, and all files in the folder receive synchronized timestamps to eliminate metadata-based identification of the active vault. History and sync data are stored as additional encrypted files of the same format, making it impossible to distinguish real from decoy vaults from the filesystem alone. The approach mirrors VeraCrypt hidden volumes but operates on ordinary files and folders, with the explicit goal of providing deniability when a user is compelled to reveal a password.