In the quiet architecture of digital trust, BleachBit 6.0.4 arrives this week as a reckoning with a fundamental assumption — that deleted means gone. Windows users who relied on earlier versions to permanently erase sensitive files may find that fragmentation, the ordinary scattering of data across a disk, preserved what they believed destroyed. The release addresses not only this critical flaw but a constellation of security vulnerabilities, while extending the tool's reach to macOS for the first time, marking a maturation of open-source privacy infrastructure across all major platforms.
BleachBit 6.0.4 patches critical Windows file-wiping flaw that left fragments on disk
Parts of your supposedly deleted file just sit there on the disk.
Mark
So the core problem here is that when you delete a file on Windows with an earlier version of BleachBit, it doesn't actually get wiped completely?
Mimi
Right. Windows fragments files across the disk—scatters them into pieces—and BleachBit's wiping process was skipping some of those fragments. So parts of your supposedly deleted file just sit there on the disk.
Luke
But the release notes don't say which versions had the bug or how much of each file survived. That's a real gap. You can't actually know if your data is at risk.
Mimi
Exactly. And you can't go back and re-shred the original because it's already gone. The only option is to wipe free space on the whole drive.
Mark
That sounds like a lot of work for people who thought they were already safe. What about the browser tracking stuff?
Mimi
Browsers keep a list of sites that require HTTPS. Any website can write to that list, and those entries survive when you clear your cookies. Trackers use it as a hiding place for tracking identifiers.
Luke
So it's a supercookie, essentially. It outlives the normal cookie purge.
Mimi
Exactly. BleachBit now deletes that dynamic HSTS data from six Chromium browsers and from Zen, a Firefox fork.
Mark
And the command injection fixes—those sound serious.
Mimi
They are. The tool was calling Windows commands by name instead of by full path, which means if an attacker could drop a malicious binary earlier in the search path, it would run instead.
Luke
That's a classic privilege escalation vector. How many versions were vulnerable?
Mimi
The release doesn't say. But it's fixed now—ipconfig and taskkill are called by absolute path.
Mark
What about the macOS support? Is that production-ready?
Mimi
It's early but functional. You get a Safari cleaner, support for Chrome and Firefox, full command-line tools. The GUI is still being built out.
Luke
So macOS users can use it, but the experience isn't complete yet.
Mimi
Right. It's a real platform now, but it's still settling in.
The Pulse
- Files that Windows users believed permanently shredded may still be recoverable, because earlier BleachBit versions silently skipped fragmented disk clusters during the wiping process.
- The flaw's scope is undefined — release notes name no specific vulnerable versions, leaving users unable to determine by version number alone which past wipes may have failed.
- Since the original files are already gone, the only available remedy is wiping free space across entire affected drives, a slow and imprecise corrective measure.
- Beyond the core fix, the update closes a web of attack vectors: command injection, symlink exploitation, XML entity expansion, path traversal, regex denial-of-service, and supercookie tracking across six Chromium browsers and Firefox derivatives.
- BleachBit now runs on macOS for the first time, bringing Safari cleaning, command-line support, and a graphical interface in development to an audience the tool has never previously served.
In the quiet architecture of digital trust, BleachBit 6.0.4 arrives this week as a reckoning with a fundamental assumption — that deleted means gone. Windows users who relied on earlier versions to permanently erase sensitive files may find that fragmentation, the ordinary scattering of data across a disk, preserved what they believed destroyed. The release addresses not only this critical flaw but a constellation of security vulnerabilities, while extending the tool's reach to macOS for the first time, marking a maturation of open-source privacy infrastructure across all major platforms.
BleachBit released version 6.0.4 this week with a critical fix for a Windows vulnerability that left fragments of supposedly erased files recoverable on disk. The problem was rooted in how the software handled fragmented files — a routine condition on Windows, where the operating system scatters data across noncontiguous disk clusters. Earlier versions skipped some of those clusters during wiping, meaning sensitive material users believed permanently destroyed could still be reconstructed.
The release notes do not identify which prior versions carried the flaw or how much of a file might survive an incomplete wipe. This leaves affected users in an uncomfortable position: since the original files are already gone, re-shredding them is impossible. The only recourse is wiping free space on affected drives — overwriting unused disk areas where fragments may still linger — a more time-consuming process with no guarantee of precision.
The update also addresses a category of browser tracking that survives ordinary cookie deletion. Chromium and Firefox maintain a dynamic HSTS list — a record of sites that have requested HTTPS-only connections — which any visited site can write to, turning it into a covert tracking mechanism. BleachBit now purges this data from six Chromium-based browsers and from Zen, a Firefox derivative.
Security hardening runs deep throughout the release. On Windows, system commands are now called using absolute paths, closing a vector where a malicious binary planted earlier in the execution chain could be invoked instead. Symlink attacks are blocked, reparse points rejected during truncation, and users warned when wiping files on world-writable drives. Path traversal vulnerabilities are sealed — the software refuses to shred working directories or their parents, and on POSIX systems will not delete root directories like /, /proc, or /sys even if the protection list is empty.
XML parsing is hardened against entity expansion attacks across all entry points. Glob pattern wildcard counts are capped against regex denial-of-service. SQLite queries and URI construction are hardened against injection. When running as root on Unix systems, BleachBit now sanitizes environment variables and strips LD_LIBRARY_PATH before spawning subprocesses. Debug logs are created with 0600 permissions, download directories with 0700.
Perhaps most significantly, BleachBit now runs on macOS for the first time — with a Safari cleaner, support for Chrome and Firefox, full command-line functionality, and a graphical interface still in development. The tool warns when Full Disk Access is disabled, posts native notifications, and responds to Cmd+Q. A platform that has long been absent from BleachBit's reach now joins Windows and Linux as part of its expanding audience.
BleachBit, the open-source file-wiping tool, released version 6.0.4 this week with a critical fix for a Windows vulnerability that left fragments of supposedly deleted files recoverable on disk. The problem lay in how the software handled fragmented files—the normal state of affairs on Windows, where the operating system scatters a file across noncontiguous clusters whenever it cannot find a single continuous space large enough to hold it. Earlier versions of BleachBit skipped some of these clusters during the wiping process, meaning that sensitive data users believed they had permanently erased could still be pieced together from the disk.
The release notes do not specify which prior versions contained the flaw or quantify how much of a given file might survive the incomplete wipe. This creates a practical problem for anyone who used an earlier build to shred confidential material: there is no way to identify which files are at risk by version number alone. Since the original files are already gone, re-shredding them is impossible. The only recourse is to wipe the free space on affected drives, a more time-consuming process that overwrites the unused portions of the disk where fragments may linger.
Beyond the Windows file-wiping fix, version 6.0.4 addresses a category of tracking vulnerabilities in web browsers. Chromium and Firefox maintain a dynamic HSTS list—a record of which websites have instructed the browser to load them exclusively over HTTPS. Any site a user visits can write to this list, turning it into a covert storage mechanism for tracking identifiers. These bits of data survive ordinary cookie deletion, allowing trackers to reassemble a user's identity across multiple domains. BleachBit now purges this dynamic HSTS data from six Chromium-based browsers and from Zen, a Firefox derivative.
The update hardens the tool against multiple attack vectors. On Windows, the software now calls system commands like ipconfig and taskkill using absolute paths rather than relying on the search path, closing a window where an attacker could plant a malicious binary earlier in the execution chain. The DLL search path receives similar hardening. Symlink attacks are blocked—BleachBit no longer follows symbolic links during file wiping and refuses to delete files through symlinks on Windows. Reparse points are rejected during truncation. The tool now warns users when they attempt to wipe files on world-writable drives, where the operation cannot be safely completed.
Path traversal vulnerabilities are sealed off. The software now refuses to shred the working directory or its parent, closing a gap where empty strings, periods, or double-periods could collapse into the current directory. On POSIX systems, BleachBit will not delete root directories like /, /proc, /sys, or /run even if the protection list is empty. Malformed file URIs from the clipboard are skipped rather than acted upon.
XML parsing receives comprehensive protection against entity expansion attacks. The tool rejects document type definitions across all parsing entry points, and the update-check mechanism parses XML as raw bytes to ensure the rejection applies even to documents that declare an encoding. Insecure URLs for winapp2 definitions and update checks are refused. The wildcard count in glob patterns is capped to defend against regex denial-of-service attacks. SQLite queries and URI construction are hardened against injection. Downloaded model files are checksummed, and URLs opened in a browser are restricted to http and https protocols.
When running as root on Unix-like systems, BleachBit now sanitizes the PATH environment variable, removes code-loading variables before spawning subprocesses, and strips LD_LIBRARY_PATH from the environment passed to external commands. Debug logs are created with restrictive 0600 permissions, and download directories with 0700 permissions. The Windows build infrastructure moved from AppVeyor to GitHub Actions, and a CodeQL workflow was added to detect bugs through static analysis.
The release expands cleaner support for Android Studio, Gradle caches, the fish shell, Zsh, and Python command history—all repositories where credentials and sensitive commands can accumulate. The Claude cleaner now removes top-level log files. Most significantly, BleachBit now runs on macOS with a Safari cleaner, support for existing cleaners like Google Chrome and Firefox, full command-line functionality, and a graphical interface still under development. The tool warns when Full Disk Access is disabled, posts native notifications, responds to Cmd+Q, and deletes empty folders after cleaning the trash. macOS users represent a new audience for a tool that has long dominated on Windows and Linux.
Notable Quotes
If you shredded a sensitive file on Windows with an earlier build, parts of it may still sit on the disk where the wipe missed.— BleachBit 6.0.4 release notes
Want the full story?
Read the original at Help Net Security ↗
General News