From 8ee1d106efb5fcf330b0b1a17fb26c2b86b3ec6d Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 14 Jul 2026 09:22:05 -0400
Subject: [PATCH 1/2] mullvad-browser: 15.0.16 -> 15.0.18

changelog: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/mb-15.0.18-build1/projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt
diff: https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/compare/mullvad-browser-140.12.0esr-15.0-1-build2...mullvad-browser-140.12.0esr-15.0-1-build3
firefox security advisories: https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/

Fixes: CVE-2026-15718, CVE-2026-15719
(cherry picked from commit bcfc305c8723f270fa3c816cd4308b41ec92b8a8)
---
 pkgs/by-name/mu/mullvad-browser/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mu/mullvad-browser/package.nix b/pkgs/by-name/mu/mullvad-browser/package.nix
index f718e178f988..241cfe2420bd 100644
--- a/pkgs/by-name/mu/mullvad-browser/package.nix
+++ b/pkgs/by-name/mu/mullvad-browser/package.nix
@@ -97,7 +97,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.16";
+  version = "15.0.18";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-mlQUAdGcOUbqReROqhs4fwSUmTZqQAEhwsg6ulM2hx4=";
+      hash = "sha256-hvLft1HDj/5NgAfQb1igYdhJN5H/jZ2+7s/JKKLf4Gs=";
     };
   };
 

From dfaf107e8e74e609121ec1a2cbe4c56ae368b1b4 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 14 Jul 2026 10:02:50 -0400
Subject: [PATCH 2/2] tor-browser: 15.0.17 -> 15.0.18

release announcement: https://blog.torproject.org/new-release-tor-browser-15018/
changelog: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/tbb-15.0.18-build1/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt
diff: https://gitlab.torproject.org/tpo/applications/tor-browser/-/compare/tor-browser-140.12.0esr-15.0-1-build2...tor-browser-140.12.0esr-15.0-1-build3
firefox security advisories: https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/

Fixes: CVE-2026-15718, CVE-2026-15719
(cherry picked from commit 04e210b7cb5067e638000b73d97f3b05e9bcd673)
---
 pkgs/by-name/to/tor-browser/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/to/tor-browser/package.nix b/pkgs/by-name/to/tor-browser/package.nix
index 94533b096c75..353662fe970c 100644
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -102,7 +102,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.17";
+  version = "15.0.18";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -112,7 +112,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-WJFDd+DVj4oKHjv7py3yVrttrrCHFcHJbyvLNOwCjhs=";
+      hash = "sha256-4e7G8M/iKU65ECMVhxGjaJwHfwVZ49RD7ro6YJT43v0=";
     };
 
     i686-linux = fetchurl {
@@ -122,7 +122,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-pKmAKDWutSp7ptJ66PMiS59aV+pRs3Oz9pV64kRuebI=";
+      hash = "sha256-lLShsQQ2thSSp4PRK9Fhza6e01Myj2mUP4qqCeyilXo=";
     };
   };