GitLab

Consider setting the Tor Browser configuration item middlemouse.contentLoadURL to false by default. When its value is "true", pressing mouse's middle button when there is a URL in the clipboard, makes the browser open that URL.

In my experience this is a significant risk, and has bitten me at least once by making me load by mistake a user identifying page in my tor session. My intention was to open a link on the page in a new tab, but I failed to click the link area, so the middle button click instead opened a URL that happened to be in the clipboard. That URL pointed to a page that revealed my real identity. The inconvenience caused to the user by this configuration change seems minimal to me.

Trac:
Username: beadcafe