Mullvad Browser

Is Mullvad Browser safe?

Yes, for privacy it is one of the strongest desktop browsers you can install, with two limits you should know about. The Tor Project builds it for Mullvad VPN AB from the same code as Tor Browser, minus the Tor network. Telemetry is removed when the browser is compiled, history and cookies vanish when you close it, and every user is meant to look the same to trackers. We score it 84/100, a point behind Tor Browser (85), level with DuckDuckGo (84) and ahead of Brave (80).

The limits are simple. It does not hide your IP address unless you add a VPN, and it shows no warnings for phishing or malware sites. It also runs only on Windows, macOS and Linux.

What does Mullvad Browser collect?

Nothing about you, as far as the public record shows. Mullvad's "hard facts" page says telemetry and crash reporting are "entirely disabled in the browser at compile time", and that the program that would send telemetry to Mozilla has been removed. Mullvad says it earns no money from the browser: its income comes from the VPN.

The same page lists the only connections the browser makes on its own: update checks to Mullvad, Mullvad's DNS over HTTPS service, updates for the built-in NoScript and uBlock Origin add-ons, certificate checks and filter-list updates. That is an unusually complete disclosure. Mullvad Browser has no app-store listing, so there is no Apple or Google privacy label to compare it with; we scored privacy on this page and the browser's design.

Private browsing is on by default. Pages, form entries, downloads and cookies are wiped after the last window closes, and third-party cookies are kept in separate jars while you browse. DuckDuckGo is the default search engine, with suggestions switched off.

How does it stop tracking?

By making users look alike, the method Tor Browser uses. The browser reports UTC as your time zone, a common version number and operating system, and a limited set of fonts. Letterboxing rounds the window to multiples of 200 by 100 pixels, which explains the grey bars around pages. uBlock Origin blocks third-party trackers, with extra lists for tracking parameters in links and cookie banners.

This only works if you leave it alone. Every add-on, theme or changed setting makes you easier to single out. Mullvad even removed the security-level button from the toolbar in version 14.0 because changing the level alters your fingerprint, although the setting is still in the menu.

How secure is Mullvad Browser?

About as secure as Tor Browser, with less outside checking of its own. It runs on Firefox's Extended Support Release, so Firefox flaws reach it. CVE-2024-9680, a flaw Mozilla said was "exploited in the wild" in October 2024, was fixed in Firefox ESR 115.16.1, the base Mullvad Browser then used. Fixes arrive with Tor Browser's: version 15.0.26 came out for both on 21 October 2026. Before each move to a new ESR version, the developers review a year of Firefox changes and switch off any that could hurt privacy or security.

What is missing is evidence specific to this browser. The 2023 Radically Open Security audit covered Tor Browser for desktop and Android, not Mullvad Browser, and we found no separate audit. The Tor Project's HackerOne bug bounty pays for Tor Browser flaws, which Mullvad Browser shares, but does not list Mullvad Browser itself. The test channel (Alpha) moved to Firefox's faster Rapid Release in March 2026; Mullvad warns at-risk users to stay on the Stable channel.

Scams and phishing

This is the weakest area. Tor Browser switches off Google Safe Browsing to avoid sending your browsing to Google, and Mullvad Browser's list of automatic connections includes no such check either. So a known phishing page or malware download gets no red warning. uBlock Origin blocks many malicious ads, but not a convincing fake bank login you open from an email.

Unlike Tor Browser, it does not open .onion sites, so it does not lead you to the dark web by default. There are no accounts, chats or feeds of its own. Fake download sites are the other risk with any privacy tool, which is why Mullvad publishes a guide to checking the installer's signature.

How to use Mullvad Browser safely

1. Download it only from mullvad.net and check the signature with the guide Mullvad provides.
2. Use it with a VPN you trust, such as Mullvad VPN, if you want to hide your IP address. Without one, websites see where you connect from.
3. Do not install extra add-ons or change fingerprinting settings.
4. Check web addresses yourself before typing a password, since the browser will not warn you about phishing.
5. Stay on the Stable channel and install updates when they appear.

How we scored it

Privacy (93) is close to Tor Browser's: nothing collected, every connection disclosed, history wiped on exit. It is not higher because the browser does not hide your IP address by itself. Security (82) inherits Firefox's flaws and lacks an audit of its own. Scams and harmful content (64) is the weakest factor, because there are no phishing or malware warnings. The regulatory record (88) is clean but short, and no regulator has examined the browser.