browser/app/profile/000-tor-browser.js

@@ -21,8 +21,6 @@ pref("network.proxy.socks_remote_dns", true);
 pref("network.proxy.no_proxies_on", ""); // For fingerprinting and local service vulns (#10419)
 pref("network.proxy.allow_hijacking_localhost", true); // Allow proxies for localhost (#31065)
 pref("network.proxy.type", 1);
-// Bug 40548: Disable proxy-bypass
-pref("network.proxy.failover_direct", false);
 // localhost is already blocked by setting `network.proxy.allow_hijacking_localhost` to
 // true, allowing users to explicitly block ports makes them fingerprintable; for details, see
 // Bug 41317: Tor Browser leaks banned ports in network.security.ports.banned

browser/app/profile/001-base-profile.js

@@ -455,6 +455,8 @@ pref("network.protocol-handler.warn-external.snews", true);
   pref("network.protocol-handler.warn-external.ms-windows-store", true);
 #endif
 pref("network.proxy.allow_bypass", false, locked); // #40682
+// Bug 40548: Disable proxy-bypass
+pref("network.proxy.failover_direct", false, locked);
 // Lock to 'true', which is already the firefox default, to prevent users
 // from making themselves fingerprintable by disabling. This pref
 // alters content load order in a page. See tor-browser#24686