# languagechange event fires simultaneously on all tabs

Tor Browser fires the languagechange event simultaneously across all tabs, letting a malicious ad provider correlate separate visits to one user via matching timestamps.

- Payout: $100
- Severity: low
- Program: Tor
- Credited: tomvg
- Disclosed: 2017-10-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/257942
- Library page: https://bugbountylibrary.com/r/h1%3A257942
- Tags: domain:browser impact:data-leak kind:bounty platform:hackerone sev:low tech:firefox technique:js-analysis vuln:info-disclosure

**Target:** Browser languagechange event / cross-tab timing side channel
**Root cause:** The languagechange event is broadcast to all tabs at the same instant, unlike online/offline events which Tor Browser suppresses for exactly this cross-tab correlation threat.
**Steps:**
1. Open `http://192.31.23.250/_events/get-event-values.html` and `https://poc.tom.vg/events-session-associate/get-event-values.html` in two different tabs (different origins)
2. Select `onlanguagechange` from the dropdown and press Start on both
3. Change browser language in `about:preferences#content` (add/remove/reorder a language)
4. Observe both tabs log the event with approximately the same timestamp
**How found:** Noticed that online/offline events are already disabled in Tor Browser to prevent cross-tab correlation, then hypothesized languagechange was overlooked and tested it across two origins.
**Exploitation:** A malicious ad provider embeds a script on many sites that listens for languagechange and reports the event timestamp to its server. When the same rare event fires on multiple tabs at the same millisecond, the server links those visits to one user, defeating Tor Browser's cross-origin isolation.
**Insight:** When a browser suppresses one global event (online/offline) for anti-fingerprinting, enumerate sibling global events (languagechange, storage, visibilitychange) that share the same cross-tab broadcast semantics and test each for timestamp correlation across origins.