New vectors for fingerprinting Tor Browser

And it's infinitely worse than Java or Flash due to how deeply it's ingrained into the same process used to load potential attacker sites.

I wouldn't use any browser that, out of the box, isn't designed to allow the user to make an informed choice to *whitelist* all of those when they're really necessary; it's literally a remote arbitrary code execution vector. The Tor project seems to not be quite as paranoid.