Tails just pushed out an emergency update to plug a hole that lets attackers escape the Tor Browser sandbox and read sensitive files from user sticks. Automatic upgrades preserve existing data for anyone running version 7.0 or newer but fresh installs wipe the persistent storage entirely. The developers also fixed some annoying test suite issues and added exFAT support so bootloaders can actually find the ISO image on certain partitions. Skipping this update leaves anonymity tools exposed to targeted exploitation attempts that bypass standard security confinement measures.

Tails 7.6.2 Emergency Release Closes Flatpak Sandbox Hole

The latest emergency release for the Tor anonymity network addresses a critical vulnerability that could let attackers bypass security confinement within the browser. This update forces an upgrade to Flatpak version 1.16.6 because the old build allowed sandbox escapes that threaten Persistent Storage data. Anyone needing to upgrade their system to Tails 7.6.2 should prioritize this patch before continuing normal operations as the risk extends beyond standard browsing habits.

• 
• 
• 

Why the Tails 7.6.2 Update Matters

Security researchers found a way for a malicious actor to break out of the Tor Browser container using CVE-2026-34078 in the sandbox layer. While the exploit chain requires an initial compromise, the potential damage includes reading files that usually stay locked down behind password walls. It is not a remote code execution bug waiting to be triggered by a website visit but rather a risk for those under targeted attack scenarios where persistence matters most.

How to Upgrade Without Losing Data

Automatic upgrades work fine if the system started from version 7.0 or later and can connect to update servers during boot. Users should verify their current version through the dashboard before initiating any changes to ensure compatibility with the new Flatpak package. Installing on a fresh stick wipes Persistent Storage entirely so copying data back manually is necessary for those who skipped automatic maintenance windows.

• Download for USB sticks (USB image)
• Download for DVDs and virtual machines (ISO image)

What Changed Under the Hood

The developers finally stopped tolerating messy git histories in pull requests and now reject merge requests containing fixup commits. GitLab CI ensures test-ci-configuration has all the history it needs to run properly without failing pipelines on minor branch differences. Support for exFAT in initramfs ensures kexec-based bootloaders can locate the ISO image on partitions where older kernels struggled to find files during startup.

Stay safe out there and remember that software rot happens faster than hardware failure sometimes.