The Tor browser has a bug that could allow JavaScript to execute on websites even when users think they’ve disabled it for maximum anonymity.
Source: Naked Security Sophos New feed
Tor browser fixes bug that allows JavaScript to run when disabled