Web browser security summary

Table of Contents

1. Vulnerabilities
2. Publicly disclosed without a patch
3. Fully-disclosed
4. Patch delay
5. Graphs
   1. Total vulnerabilities
   2. Fully-disclosed vulnerabilities

Vulnerabilities

Up

The following table details the number of vulnerabilities and relative danger.

Historical cumulative values are provided in three forms: for all vulnerabilities in the entire of life of these products, for all vulnerabilities that were present within the first 365 days of the first vulnerability reported in the product, and for all vulnerabilities that were present within the last 365 days.

“High severity” values include vulnerability reports that were marked as “highly critical” and above. Relative danger levels are calculated by adding up the square of the criticality levels for each vulnerability report (not critical=1², extremely critical=5²).

A vulnerability is considered unfixed if the vulnerability report does not have a complete vendor patch.

Notice: Since Internet Explorer 7 was released, Secunia has not indicated which previously known unfixed Internet Explorer 6 vulnerabilities have been re-tested in IE 7, aside from the most recent few (which, by the way, were confirmed to still affect the new version). Secunia has a history of not listing very old vulnerabilities under new versions even if they still apply, and this is as true with Firefox and Opera as is assumed with Internet Explorer. Until Secunia updates the old advisories with an indication of the status in IE 7, this page will assume they still exist.

Notice: Safari for Windows is still fairly new, so there isn't much data yet. The current figures may not be particularly representative of the overall product.

Security vulnerabilities

Aspect	Internet Explorer	Firefox	Safari	Opera
Historical cumulative values (Product life)
Vulnerability reports	132	68	3	62
High severity vulnerability reports	61	24	2	16
Vulnerability issues	258	220	6	78
Relative danger	1448	625	36	525
Historical cumulative values (from first 365 days)
Vulnerability reports	31	20	3	18
High severity vulnerability reports	13	2	2	4
Vulnerability issues	69	39	6	23
Relative danger	331	156	36	138
Historical cumulative values (from last 365 days)
Vulnerability reports	49	21	3	8
High severity vulnerability reports	7	7	2	6
Vulnerability issues	63	50	6	15
Relative danger	286	171	36	109
Highest values at one time
Vulnerability reports	39	9	1	4
High severity vulnerability reports	5	2	1	1
Vulnerability issues	41	13	2	8
Relative danger	204	44	16	27
Mean average per day (from last 365 days)
Vulnerability reports	36.2	6.95	0.86	0
High severity vulnerability reports	1	0	0.41	0
Vulnerability issues	38.2	7.95	1.71	0
Relative danger	156.74	24.32	8.36	0
Median average per day (from last 365 days)
Vulnerability reports	36	7	1	0
High severity vulnerability reports	1	0	0	0
Vulnerability issues	38	8	2	0
Relative danger	156	24	4	0
Present values
Vulnerability reports	39	7	1	0
High severity vulnerability reports	1	0	0	0
Vulnerability issues	41	8	2	0
Relative danger	165	24	4	0

Internet Explorer has had 132 vulnerability reports. 22 were marked as moderately critical, 46 were marked as highly critical, and 15 were marked as extremely critical. There are still 39 remaining, including 9 that were marked as moderately critical and 1 that was marked as highly critical.

Firefox has had 68 vulnerability reports. 19 were marked as moderately critical, 24 were marked as highly critical, and 0 were marked as extremely critical. There are still 7 remaining, including 1 that was marked as moderately critical.

Safari has had 3 vulnerability reports. 0 were marked as moderately critical, 2 were marked as highly critical, and 0 were marked as extremely critical. There is still 1 remaining, which was marked as less critical.

Opera has had 62 vulnerability reports. 20 were marked as moderately critical, 15 were marked as highly critical, and 1 was marked as extremely critical. All of the reported vulnerabilities have since been fixed.

Publicly disclosed without a patch

Up

Many vulnerabilities are discovered by the browser vendors and patched before they are ever publicly known. Vulnerabilities are most dangerous when they are found elsewhere with no patch available. The following are historical cumulative vulnerability values that only include those vulnerabilities that were publicly known before a patch was available.

Security vulnerabilities (in public)

Aspect	Internet Explorer	Firefox	Safari	Opera
Historical cumulative values (Product life)
Vulnerability reports	95	39	2	30
High severity vulnerability reports	28	6	1	4
Vulnerability issues	125	51	4	35
Relative danger	858	253	20	212
Historical cumulative values (from first 365 days)
Vulnerability reports	22	14	2	14
High severity vulnerability reports	5	1	1	3
Vulnerability issues	31	17	4	19
Relative danger	185	100	20	105
Historical cumulative values (from last 365 days)
Vulnerability reports	42	12	2	1
High severity vulnerability reports	1	1	1	0
Vulnerability issues	44	13	4	1
Relative danger	177	53	20	4

Internet Explorer has had 95 reports of vulnerabilities discovered in the public without a patch. 20 were marked as moderately critical, 17 were marked as highly critical, and 11 were marked as extremely critical.

Firefox has had 39 reports of vulnerabilities discovered in the public without a patch. 11 were marked as moderately critical, 6 were marked as highly critical, and 0 were marked as extremely critical.

Safari has had 2 reports of vulnerabilities discovered in the public without a patch. 0 were marked as moderately critical, 1 was marked as highly critical, and 0 were marked as extremely critical.

Opera has had 30 reports of vulnerabilities discovered in the public without a patch. 10 were marked as moderately critical, 3 were marked as highly critical, and 1 was marked as extremely critical.

Fully-disclosed

Up

The following values only include vulnerabilities that had publicly known exploits or proof-of-concept exploit code before a patch was available, according to Secunia's advisories.

It should be noted that not all theoretical exploits hold the same likelihood of attack. Some vulnerabilities may have publicly available proof-of-concept code that is very difficult to exploit in practice. Criticality levels often provide some indication of the ease of exploitation, but they also represent the sheer potential impact of the flaw whether easily exploitable or not.

Security vulnerabilities (fully-disclosed)

Aspect	Internet Explorer	Firefox	Safari	Opera
Historical cumulative values (Product life)
Vulnerability reports	44	13	2	9
High severity vulnerability reports	17	2	1	1
Vulnerability issues	64	14	4	13
Relative danger	477	74	20	66
Historical cumulative values (from first 365 days)
Vulnerability reports	6	2	2	3
High severity vulnerability reports	1	0	1	1
Vulnerability issues	6	2	4	7
Relative danger	41	13	20	30
Historical cumulative values (from last 365 days)
Vulnerability reports	18	8	2	1
High severity vulnerability reports	0	1	1	0
Vulnerability issues	19	8	4	1
Relative danger	66	35	20	4
Highest values at one time
Vulnerability reports	15	7	1	2
High severity vulnerability reports	3	1	1	1
Vulnerability issues	16	7	2	6
Relative danger	107	31	16	25
Mean average per day (from last 365 days)
Vulnerability reports	13.55	4.25	0.86	0
High severity vulnerability reports	0	0	0.41	0
Vulnerability issues	14.55	4.25	1.71	0
Relative danger	48.19	10.42	8.36	0
Median average per day (from last 365 days)
Vulnerability reports	13	4	1	0
High severity vulnerability reports	0	0	0	0
Vulnerability issues	14	4	2	0
Relative danger	46	10	4	0
Present values
Vulnerability reports	15	4	1	0
High severity vulnerability reports	0	0	0	0
Vulnerability issues	16	4	2	0
Relative danger	54	10	4	0

Internet Explorer has had 44 fully-disclosed vulnerability reports. 5 were marked as moderately critical, 6 were marked as highly critical, and 11 were marked as extremely critical. There are still 15 remaining, including 3 that were marked as moderately critical.

Firefox has had 13 fully-disclosed vulnerability reports. 2 were marked as moderately critical, 2 were marked as highly critical, and 0 were marked as extremely critical. There are still 4 remaining, all of which were marked as less critical or not critical.

Safari has had 2 fully-disclosed vulnerability reports. 0 were marked as moderately critical, 1 was marked as highly critical, and 0 were marked as extremely critical. There is still 1 remaining, which was marked as less critical.

Opera has had 9 fully-disclosed vulnerability reports. 3 were marked as moderately critical, 0 were marked as highly critical, and 1 was marked as extremely critical. All of the reported vulnerabilities have since been fixed.

Patch delay

Up

It is also important to consider how quickly each web browser fixes its vulnerabilities. The following table lists the average time taken between Secunia's vulnerability reports and the release dates of their respective patches, if all aging unfixed vulnerabilities (vulnerabilities at least as old as the mean of all fixed vulnerabilities for that browser) were to be fixed today. Data does not include unfixed vulnerabilities less than that age, vulnerabilities with unknown fix dates, or vulnerabilities that were only publicly known after the patch release. Values listed are in days.

Patch delay (in days)

Average	Internet Explorer	Firefox	Safari	Opera
Per vulnerability report
Overall mean	644	175	24	76
Overall median	447	44	24	29
High severity mean	142	11	23	8
High severity median	53	8	23	8
Per vulnerability issue
Overall mean	543	161	24	118
Overall median	210	23	24	44
High severity mean	128	17	23	8
High severity median	65	23	23	8
Weighted by relative danger
Overall mean	483	158	23	65
Overall median	144	22	23	21
High severity mean	135	11	23	7
High severity median	53	8	23	1
Per fully-disclosed vulnerability report
Overall mean	459	181	24	77
Overall median	119	17	24	11
High severity mean	60	5	23	1
High severity median	50	5	23	1

Graphs

Up

The following graphs illustrate present security figures in each browser over time. The graphs span from February 9, 2004 to today.

← Back to Web Devout home

This work is copyright © 2008 David Hammond and is licensed under a Creative Commons Attribution Share-Alike License. It may be copied, modified, and distributed freely as long as it attributes the original author and maintains the original license. See the license for details.

• About Web Devout
• Privacy policy
• FAQ
• Blog
• Discussion
• Search
• Contact me