For most people, their web browser is central to their interaction with the Internet, connecting to global web sites and helping them consume online services providing everything from booking flights to banking services to online shopping. This reality makes browsers a key tool when evaluating the security experience of users as the browser interprets Web content and programs delivered from around the world.
Over the past few years, there has been much discussion of the need for improvements in browser security, but few hard data studies performed to support assertions concerning the security of available browsers.
I've just finished up and posted for download a vulnerability analysis of Internet Explorer and Firefox, including fixed and unfixed vulnerabilities, that covers roughly the past three years since Firefox first released.
As usual for these, I want to post one chart as a teaser to get you to go look at the full report. In this case, I'm choosing one that looks at alternative upgrade paths. Let's say you deployed Firefox 1.0 and then Firefox 1.5 came out - did you upgrade immediately or did you wait until support for Firefox 1.0 was ending? (... or maybe you're still using 1.0... tsk tsk) Same question for 2.0. Take a look at this chart:
This chart looks at four cases starting back in the Autumn of 2004:
- Firefox 1.0 users that upgraded to 1.5 and 2.0 immediately
- Firefox 1.0 users that upgraded only when support ended
- IE 6 SP2 users that upgraded to IE 7 immediately
- IE 6 SP2 users that did not upgrade to IE 7
So, how do the findings line up with your expectations? Go over to this download page and download the full report to see other findings, including unfixed issues on the latest releases...
where is the promised ie 8 ??
I think merely counting vulnerabilities is insufficient data to conclude anything about browser security, because one also needs to consider how much a browser is targeted. A vulnerability in one browser might not pose the same risk of a vulnerability in the other browser (even if they are both remote exploitation vulns). The Honeynet Project's Know Your Enemy study on Malicious Web Servers paper (http://www.honeynet.org/papers/mws) illustrates. Although Firefox did contain more remote execution vulnerabilities, it was less attacked than Internet Explorer. This is probably the case because Firefox usually patches more quickly and there is a better ROI on the exploits as more users are using Internet Explorer.