If it's not a secret, how much did they pay to you? Seems like this could be considered, at least, a medium severity, and the top bounty they gave so far is only $500. If you don't wanna disclose that, that's perfectly understandable. I'm just curious.

It sounds like it's a privacy leak, but not an RCE/SBX? Especially as it's saying that the sandboxed version of Tor isn't affected.

Bit sad that you can't click the revisions on https://trac.torproject.org/projects/tor/ticket/23044#no2 to see the diff.

I'm thinking it's a combination of being the default, Firefox just having enabled the sandbox on Linux, and it being the base of the Tor Browser (which means Firefox exploits can sometimes be used against Tor too).