Tails 7.3.1 Ships with Vertical Tabs and Security Fix

Tails dropped version 7.3.1 on December 11, 2025, and the version number tells a story. The team skipped 7.3 entirely because a security vulnerability was patched in an included software library while they were preparing the release. Rather than ship code they knew had a fix available, they restarted the entire release process to incorporate the patch. The Tails developers chose to absorb that delay rather than push known-vulnerable software to users who depend on this operating system to stay alive.

The headline feature arrives through Tor Browser 15.0.3, which represents a year's worth of upstream Firefox development landing in a single update. Based on Firefox 140 ESR, this release introduces vertical tabs a sidebar layout that replaces the traditional horizontal tab bar for users who prefer managing their browsing sessions that way. You can organize tabs into collapsible groups with custom names and color coding, which matters when you're juggling multiple research threads across different onion services.

The Tor Project's security team conducted their annual ESR transition audit, reviewing hundreds of Bugzilla issues and specifically hunting for changes that might compromise privacy or security. They've also restructured how WebAssembly gets handled. Previously, Wasm was globally disabled at higher security levels, which broke Firefox's PDF reader since it now relies on WebAssembly. Control has shifted to NoScript, so the PDF reader functions normally while Wasm remains blocked on websites when using Safer or Safest security modes.

Under the hood, Tails 7.3.1 updates the Tor client to version 0.4.8.21 and Thunderbird to 140.5.0 ESR. The email client already had Tails-specific modifications applied in version 7.2 to prevent Thunderbird from sending telemetry data to Mozilla a sensible default for an operating system designed to leave no trace.

The firmware repository has been updated to match Debian Trixie's state from November 11, 2025. This matters for hardware compatibility, particularly newer Wi-Fi adapters and graphics cards. Tails 7.x runs on the Linux 6.12.57 LTS kernel, which expanded device support significantly compared to the 6.1 kernel in the Tails 6.x series.

For context on what Tails 7.x brings overall: the 7.0 release shipped September 18, 2025, rebasing the entire operating system on Debian 13 "Trixie" with GNOME 48. Boot times dropped by 10-15 seconds on most machines thanks to switching image compression from xz to zstd, though the ISO grew approximately 10% larger as a tradeoff. GNOME Terminal was replaced with GNOME Console, and the minimum RAM requirement increased to 3 GB the Tails team estimates fewer than 2% of users will be affected by that change.

Tails 7.0 was dedicated to the memory of Lunar (1982–2024), a long-time Tor volunteer and Free Software contributor whose work on Tails, Tor, Debian, and the Reproducible Builds project shaped the privacy tools many people depend on today.

Automatic upgrades work from Tails 7.0 or later. If you're running Tails 6.x, you'll need a fresh installation since the 6.x to 7.x jump requires a new USB stick your Persistent Storage settings will need to be reconfigured. The Tails documentation walks through the process, and the extra effort is worth it given the security and performance improvements in the 7.x series.

One platform note worth tracking: Tor Browser 15.0 is the final release supporting 32-bit (x86) architectures on Linux and Android versions 5.0 through 7.0. Starting with Tor Browser 16.0, expected mid-2026, the minimum Android version rises to 8.0 and 64-bit becomes mandatory. If you're running Tails on ancient hardware, the clock is ticking on how long that configuration remains viable.

For anyone using Tails as their primary secure operating system, this update represents routine maintenance done correctly. The version skip demonstrates the project's priorities: when security fixes become available during the release pipeline, they restart rather than ship known vulnerabilities. That's the kind of operational discipline that matters when your users include journalists, activists, and anyone else whose threat model includes state-level adversaries.