The Tor browser has a software flaw that government agents may have exploited to hack unsuspecting targets.

The vulnerability deals with a software extension called NoScript, which comes with version 7.x of the browser, according to the company Zerodium, which tweeted out the details on Monday. Like its name suggests, the NoScript extension is designed to block JavaScript, Flash and other plugins from running over untrusted websites.

However, Zerodium learned of a flaw in NoScript when the extension is set on the highest safety level. Doing this can let a website that loads over the Tor browser to exploit the extension to run any Javascript code. A security researcher who goes by the name "x0rz" has uploaded video of the vulnerability in action, and called it easy to reproduce.

The good news is that Tor browser 8.0, which arrived last week, is safe from the flaw. You can install it automatically by clicking on the onion icon in left corner of the Tor browser window. NoScript's developer has also patched the vulnerability.

Recommended by Our Editors

DuckDuckGo vs. Google: One Dominates, But the Other Offers an Escape from AI Overload

Brave, Chrome, Edge, Firefox, or Safari? We Pick the Best Browser for 2026

Lose the Trackers: The Best Private Browsers for 2026

Still, the flaw's disclosure suggests that actual victims were hacked by the NoScript bug. Zerodium is a company that specializes in buying previously unknown software vulnerabilities from security researchers and then selling them to government groups.

Zerodium told ZDNet that it had bought details of the Tor browser flaw months ago, and then shared them with the company's government customers. "The exploit by itself does not reveal any data as it must be chained to other exploits, but it circumvents one of the most important security measures of Tor Browser which is provided by NoScript component," Zerodium added.

The company decided to reveal the flaw, given that it's useless against Tor version 8.0. Nevertheless, don't be surprised if Zerodium has other software exploits that work against the browser. Last year, it was offering as much as $250,000 for details on Tor-related vulnerabilities.

"In my opinion, if Zerodium is dropping this [vulnerability] as free advertising, it really means they have more stuff. Probably on the latest Tor Browser 8.0 too," tweeted the security researcher x0rz.

So far, the Tor Project hasn't commented on the flaw. The group's browser is popular among journalists, activists and cybercriminals as a way to keep your online browsing activities anonymous. However, the software isn't unhackable either. Back in 2015, FBI seized a child pornography website on the dark web and then used it to spread spyware to visitors, many of whom were probably using Tor.