Intermittent failures in Security Level change synchronization

SECURITY ISSUE

It is possible to bypass the Tor Security Settings (Shield icon next to the Tor Browser URL bar) and to run javascript even when the security level is set to Safest.

Details

I normally browse with the security level set to Safest which disables javascript, but occasionally some websites require javascript. When that is the case, I click a link/load the website using the Safest security level, go to the security level settings options, change it to Safer, and reload only the tab with the content that needs javascript. If the content loaded fine, or I'm done reading that tab, I first go back to the security levels settings and set it back to Safest before closing the tab I just finished reading and continuing browsing in other tabs.

The issue is that the security level is not always honored, for example when visually set to Safest it is actually internally set to Safer, and vice-versa.

Steps that led to this

I had been using Tor Browser for over 24 hours, with around 20 tabs open, with system sleeps and hibernations in between.

I visited a webpage on the site https://mastodon.social/, which required javascript, so I set the security level to Safer, reloaded the webpage, finished reading, and set the security level back to Safest. I then visited a page on the site https://arstechnica.com/, and noticed that javascript was enabled (ads loading, URL redirects, etc), and confirmed this by then visiting Wikipedia in another tab and using the Wikipedia search function which only displays search suggestions with javascript enabled.

I went back to the security settings (at that point set to Safest) and switched it to Safer and then back to Safest again, this fixed the issue. Now the Ars Technica webpage and Wikipedia both had javascript disabled.

After more browsing with the same instance of Tor Browser open (still around 20 tabs), after around 30 minutes I experienced the opposite issue. I visited a webpage on GitHub, which requires javascript for some features, so I set the security level to Safer and reloaded the GitHub tab, but the javascript remained disabled. I then went back to the security level and switched it back to Safest, and then to Safer again, which fixed the issue.

Some hours later (same Tor Browser instance and ~20 tabs open) I visited a page on https://gitlab.torproject.org/ which also required javascript, and the same issue as the GitHub page occurred, which was also fixed by toggling the security level to Safest and back to Safer.

I am using Tor Browser 14.0.3 on macOS 11