Browser Privacy Ranking 2026: Tor Browser Leads at 9.5 While Chrome and Yandex Rank Lowest

SecurityLab.ru has published a detailed 2026 browser privacy ranking that evaluates major browsers across six criteria including initial network behavior, site isolation, fingerprint resistance, funding model, configurability, and code auditability. Tor Browser scores highest at 9.5 for its comprehensive protections including unified fingerprinting and layered JavaScript controls, followed by Mullvad Browser at 9.0 and LibreWolf at 8.5. Brave earns 7.5 for built-in tracker blocking but faces criticism over default telemetry and cryptocurrency features. Firefox scores 6.0 out of the box yet reaches 8.5 after extensive configuration, while Google Chrome, Microsoft Edge, Opera, and Yandex Browser occupy the bottom positions due to persistent tracking mechanisms and closed-source components. The report also highlights the Local Mess localhost tracking technique used by Meta and Yandex that bypassed browser isolation entirely.

SecuritylabAugust 17, 2026Translated from Russian

Read at source

SecurityLab.ru has released its 2026 browser privacy ranking that measures real behavior rather than marketing claims. The evaluation uses six criteria: network activity immediately after installation, cross-site state isolation, resistance to browser fingerprinting, funding model, depth of configurability, and code verifiability together with the fate of content blockers.

Tor Browser 15.0 tops the list with a score of 9.5. It unifies the fingerprint, letterboxes the window, and applies JavaScript protections at multiple security levels while routing traffic through the Tor network. The 15.0 release, based on Firefox ESR 140, removed AI features and added a non-AI DuckDuckGo option.

Mullvad Browser 15.0 follows at 9.0 with the same anti-fingerprinting engine but without the Tor network, offering constant private mode and zero telemetry. LibreWolf 153.0 scores 8.5 by stripping Mozilla telemetry, pre-installing uBlock Origin, and enabling fingerprint resistance by default.

Brave 1.93 receives 7.5 for its Shields system that blocks ads and trackers at the engine level, bypassing Manifest V3 restrictions. However, it ships with P3A telemetry enabled and includes cryptocurrency features that must be disabled manually. Ungoogled Chromium 150.0 scores 7.0 for sending zero requests to Google services yet ships without any built-in ad or tracker blocking.

DuckDuckGo Browser 1.202 earns 6.5 for immediate tracker protection but still allows requests to bat.bing.com under a Microsoft syndication agreement. Safari 26.5 and Firefox 153.0 both score 6.0 out of the box; Firefox can reach 8.5 after about an hour of about:config tuning and container extensions.

Lower scores go to Vivaldi 8.1 (4.5) for its daily unique profile identifier, Microsoft Edge 151.0 (3.0) for extensive Microsoft telemetry and Copilot integration, Google Chrome 151.0 (2.5) for sending every address-bar character to Google and abandoning third-party cookie changes, Opera 134.0 (2.0) for sending visited URLs to sitecheck.opera.com, and Yandex Browser (1.5) for hardware identifiers and deep ecosystem integration.

The report also covers the Local Mess technique disclosed in June 2025 that allowed Meta Pixel and Yandex Metrika scripts to exfiltrate cookies via localhost connections to mobile apps, bypassing all browser isolation mechanisms including incognito mode.

Tor Browser Yandex Browser Firefox Safari Brave Google Chrome Mullvad Browser

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Privacy & Surveillance

Privacy & Surveillance

Maximizing iPhone Privacy: Essential Settings to Enable, Disable, and Verify Immediately

The article provides a detailed guide on strengthening iPhone privacy by limiting unauthorized access to messages, location data, photos, and cloud backups. It explains how to set a strong alphanumeric passcode, enable Stolen Device Protection, and restrict lock screen notifications and widgets. Users are advised to review Apple ID security, enable Advanced Data Protection for iCloud, and minimize app permissions for location, contacts, and camera. Additional steps include turning off cross-app tracking, using private Wi-Fi addresses, and activating Lockdown Mode for high-risk scenarios. The guide emphasizes regular updates, encrypted local backups, and periodic audits of shared access and active sessions to maintain long-term protection.

SecuritylabOct 28, 2026Translated from Russian

Privacy & Surveillance

Top 10 Secure DNS Servers for Privacy, Threat Blocking and Ad Filtering in 2026

Public DNS resolvers differ significantly in their ability to block malicious domains, filter advertising and tracking, respect user privacy, and support modern encryption protocols. The guide evaluates ten services including Quad9, Cloudflare, AdGuard DNS, NextDNS, Control D, CleanBrowsing, Mullvad DNS, DNS4EU, Google Public DNS and DNS.SB, providing IPv4 addresses, DoH and DoT endpoints, and recommended use cases. Key distinctions include Quad9’s focus on phishing and malware blocking without logging, Mullvad’s strict no-logs policy requiring encrypted protocols only, and DNS4EU’s EU-based infrastructure with mandatory court-ordered blocks. The article explains why DNSSEC and encryption alone are insufficient and outlines four practical selection criteria: threat filtering quality, data-handling practices, encryption support, and network stability. Detailed configuration instructions cover Windows 11, Android, iOS, and home routers, along with verification methods and warnings against mixing providers with conflicting policies.

SecuritylabOct 28, 2026Translated from Russian

Privacy & Surveillance

WebRTC IP Leaks Explained: Why Disabling the Protocol Harms Anonymity in Anti-Detect Browsers

The article from Aurorium details how WebRTC technology can leak real IP addresses even when users route traffic through proxies. It explains the peer-to-peer mechanics of WebRTC, the role of STUN servers in generating ICE candidates, and why standard TCP proxies fail to handle UDP traffic. Disabling WebRTC via flags or JavaScript extensions creates detectable anomalies that anti-fraud systems flag as non-standard environments. The recommended approach involves native emulation inside the browser kernel so that STUN requests return proxy IPs while preserving full API integrity across workers. Additional leaks through local network addresses, mDNS candidates, and IPv6 are also covered with practical verification methods using tools like BrowserLeaks and CreepJS.

HabrOct 26, 2026Translated from Russian