# Detecting Tor Browser UI Language

Tor Browser leaks UI language via default submit-button text width, defeating the Accept-Language privacy prompt.

- Payout: hidden
- Severity: low
- Program: Tor
- Found by: newfunction
- Disclosed: 2019-05-21
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/282748
- Library page: https://bugbountylibrary.com/r/h1%3A282748
- Tags: area:os domain:browser impact:data-leak kind:bounty platform:hackerone sev:low technique:js-analysis vuln:info-disclosure

**Target:** Tor Browser UI / HTML form rendering
**Root cause:** Default text of `<input type="submit">` without a value attribute is localized to the UI language, so its rendered width differs per language and is measurable via JS.
**Steps:**
1. Install zh-CN Tor Browser from torproject.org.
2. Visit a page that renders `<input type="submit">` (no value) and measures its width.
3. Compare width against `<input type="submit" value="Submit Query">` and `<input type="submit" value="提交查询">`.
4. Matching width reveals UI language even when 'Don't send my language' is selected.
**How found:** Observed that the default submit button label is localized, and reasoned that differing text lengths produce measurable width differences usable as a fingerprint.
**Exploitation:** A malicious page measures the width of a default submit button and compares it to known-language reference buttons to fingerprint the user's UI language, bypassing the Accept-Language opt-out.
**Insight:** Localized default UI strings (button labels, placeholders) render with language-dependent dimensions; measure element geometry to fingerprint locale even when explicit language headers are suppressed.