The Tor Project takes a major step toward launching its mobile VPN with successful Cure53 audit

Date:
Fri, 17 Apr 2026 14:13:04 +0000

Description:
The Tor Project has published the results of an independent security audit on its upcoming TorVPN app for Android. Conducted by renowned cybersecurity firm Cure53, the penetration test confirmed the core routing features are robust, while highlighting a few areas for the development team to harden before an official release.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Tech Radar Get daily insight, inspiration and deals in your inbox Sign up for breaking news, reviews, opinion, top tech deals, and more. Become a Member in Seconds Unlock instant access to exclusive member
features. Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting
your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. You are now subscribed Your newsletter sign-up was successful Join the club Get full access to premium articles, exclusive features and a growing list of member rewards. Explore An account already exists for this email address, please log in. Subscribe to our newsletter Security firm Cure53 performed a penetration test on TorVPN for Android and its Onionmasq networking layer in June 2025. The assessment found no fundamental flaws in how the application routes traffic or establishes secure tunnels to the Tor network. Developers are currently patching low-level DNS and input validation bugs that could potentially lead to denial-of-service in rare scenarios. For millions of users worldwide, the Tor network is the gold standard for staying anonymous online. Now, the developers behind the project are moving closer to launching a dedicated mobile application, and a new independent code audit suggests the technical foundations are rock solid.

In recent years, the privacy organization has been working to expand its mobile offerings, including the ongoing development of TorVPN. The ultimate goal is to make Tor-based protections much more accessible to everyday smartphone users while maintaining the strict security guarantees the network is famous for. As part of this ongoing mission, the Tor Project recently commissioned renowned cybersecurity firm Cure53 to rigorously test TorVPN for Android. You may like 'No major vulnerabilities' Mullvads WireGuard implementation gets thumbs up from independent security audit Google killed its dark web scanner, but NordVPNs upgraded tool is here to fill the void "In conclusion, the reviewed scope appears to be on a good security level
compared to systems of similar size and complexity." Independent review confirms Mullvads strong privacy protections

According to a post on the official Tor Project Forum , the penetration testing took place in June 2025, evaluating both the Android application and its underlying networking layer, known as Onionmasq.

While the mobile app isn't ready to challenge the overall best VPN providers on the market just yet, the results are incredibly promising. Cure53 reported that the software successfully maintains its core security requirements, paving the way for a safer, more private mobile browsing experience. Under
the hood of TorVPN Unlike traditional consumer VPN services that route your traffic through a centralized server, the TorVPN Android application routes a user's device traffic through the decentralized Tor network. This makes it significantly harder for internet service providers or malicious actors to track your digital footprint.

Because this level of anonymity requires flawless execution, Cure53's assessment looked closely at how TorVPN establishes its connections. The security firm also tested Onionmasq, a Rust-based tunnel interface that handles everything from low-level network traffic forwarding and TCP/UDP parsing to DNS resolution and routing traffic to the Tor network via the Arti implementation.

Thankfully, the major takeaways are highly positive. Writing on the official forum, a Tor Project representative confirmed: "The audit found that Tor's core integration remains robust, with no fundamental issues in tunnel establishment or routing." Ironing out the final bugs While the core privacy features are functioning securely, Cure53 did flag a handful of technical concerns that need to be patched before a wider rollout.

The majority of these vulnerabilities centered on "incomplete input
validation and weaknesses in DNS handling." According to the forum post outlining the audit results, these specific flaws could theoretically be exploited to create "denial-of-service conditions in certain rare
conditions," which would temporarily crash or disrupt the application.

Testers also suggested implementing better cryptographic hardening, specifically pointing out certificate pinning and randomness as areas for improvement. Additionally, the audit noted some typical mobile security quirks, including "plaintext configuration storage and lack of root detection."

If you're eager to try the app to secure your smartphone, the good news is that the Tor Project team is already on the case. The organization stated
that all findings are currently being tracked and actively addressed as part of its ongoing security work. By using this audit to prioritize resource management, tighten validation, and implement established security libraries, the final version of TorVPN for Android is shaping up to be a powerful, privacy-first tool. Today's best VPN deals NordVPN 2 Year 2.59 /mth View +3 months free Surfshark 24 Months 1.49 /mth View +4 MONTHS FREE ExpressVPN 24 month 1.74 /mth View Proton VPN 2.39 /mth View We check over 250 million products every day for the best prices powered by



======================================================================
Link to news story: https://www.techradar.com/vpn/vpn-services/the-tor-project-takes-a-major-step- toward-launching-its-mobile-vpn-with-successful-cure53-audit


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)