Web browser security summary

Table of Contents

1. Vulnerabilities
2. Publicly disclosed without a patch
3. Fully-disclosed
4. Patch delay
5. Graphs
   1. Total vulnerabilities
   2. Fully-disclosed vulnerabilities

Vulnerabilities

Up

The following table details the number of vulnerabilities and relative danger.

Historical cumulative values are provided in three forms: for all vulnerabilities in the entire of life of these products, for all vulnerabilities that were present within the first 365 days of the first vulnerability reported in the product, and for all vulnerabilities that were present within the last 365 days.

“High severity” values include vulnerability reports that were marked as “highly critical” and above. Relative danger levels are calculated by adding up the square of the criticality levels for each vulnerability report (not critical=1², extremely critical=5²).

A vulnerability is considered unfixed if the vulnerability report does not have a complete vendor patch.

Notice: Since Internet Explorer 7 was released, Secunia has not indicated which previously known unfixed Internet Explorer 6 vulnerabilities have been re-tested in IE 7, aside from the most recent few (which, by the way, were confirmed to still affect the new version). Secunia has a history of not listing very old vulnerabilities under new versions even if they still apply, and this is as true with Firefox and Opera as is assumed with Internet Explorer. Until Secunia updates the old advisories with an indication of the status in IE 7, this page will assume they still exist.

Notice: Safari for Windows is still fairly new, so there isn't much data yet. The current figures may not be particularly representative of the overall product.

Security vulnerabilities

Aspect	Internet Explorer	Firefox	Safari	Opera
Historical cumulative values (Product life)
Vulnerability reports	137	73	5	66
High severity vulnerability reports	63	28	4	18
Vulnerability issues	267	243	10	90
Relative danger	1507	690	68	565
Historical cumulative values (from first 365 days)
Vulnerability reports	31	20	5	18
High severity vulnerability reports	13	2	4	4
Vulnerability issues	69	39	10	23
Relative danger	331	156	68	138
Historical cumulative values (from last 365 days)
Vulnerability reports	47	20	5	8
High severity vulnerability reports	5	8	4	5
Vulnerability issues	58	60	10	23
Relative danger	264	171	68	97
Highest values at one time
Vulnerability reports	39	9	2	4
High severity vulnerability reports	5	2	1	1
Vulnerability issues	41	13	3	8
Relative danger	204	44	20	27
Mean average per day (from last 365 days)
Vulnerability reports	37.79	5.68	1.05	0
High severity vulnerability reports	1	0.1	0.21	0
Vulnerability issues	39.79	6.68	2.01	0
Relative danger	163.44	21.38	6.7	0
Median average per day (from last 365 days)
Vulnerability reports	38	6	1	0
High severity vulnerability reports	1	0	0	0
Vulnerability issues	40	7	2	0
Relative danger	161	20	4	0
Present values
Vulnerability reports	39	6	1	0
High severity vulnerability reports	1	0	0	0
Vulnerability issues	41	7	2	0
Relative danger	170	20	4	0

Internet Explorer has had 137 vulnerability reports. 25 were marked as moderately critical, 48 were marked as highly critical, and 15 were marked as extremely critical. There are still 39 remaining, including 10 that were marked as moderately critical and 1 that was marked as highly critical.

Firefox has had 73 vulnerability reports. 19 were marked as moderately critical, 28 were marked as highly critical, and 0 were marked as extremely critical. There are still 6 remaining, including 1 that was marked as moderately critical.

Safari has had 5 vulnerability reports. 0 were marked as moderately critical, 4 were marked as highly critical, and 0 were marked as extremely critical. There is still 1 remaining, which was marked as less critical.

Opera has had 66 vulnerability reports. 20 were marked as moderately critical, 17 were marked as highly critical, and 1 was marked as extremely critical. All of the reported vulnerabilities have since been fixed.

Publicly disclosed without a patch

Up

Many vulnerabilities are discovered by the browser vendors and patched before they are ever publicly known. Vulnerabilities are most dangerous when they are found elsewhere with no patch available. The following are historical cumulative vulnerability values that only include those vulnerabilities that were publicly known before a patch was available.

Security vulnerabilities (in public)

Aspect	Internet Explorer	Firefox	Safari	Opera
Historical cumulative values (Product life)
Vulnerability reports	96	41	3	30
High severity vulnerability reports	28	7	2	4
Vulnerability issues	126	53	5	35
Relative danger	867	270	36	212
Historical cumulative values (from first 365 days)
Vulnerability reports	22	14	3	14
High severity vulnerability reports	5	1	2	3
Vulnerability issues	31	17	5	19
Relative danger	185	100	36	105
Historical cumulative values (from last 365 days)
Vulnerability reports	42	12	3	0
High severity vulnerability reports	1	1	2	0
Vulnerability issues	44	13	5	0
Relative danger	182	50	36	0

Internet Explorer has had 96 reports of vulnerabilities discovered in the public without a patch. 21 were marked as moderately critical, 17 were marked as highly critical, and 11 were marked as extremely critical.

Firefox has had 41 reports of vulnerabilities discovered in the public without a patch. 11 were marked as moderately critical, 7 were marked as highly critical, and 0 were marked as extremely critical.

Safari has had 3 reports of vulnerabilities discovered in the public without a patch. 0 were marked as moderately critical, 2 were marked as highly critical, and 0 were marked as extremely critical.

Opera has had 30 reports of vulnerabilities discovered in the public without a patch. 10 were marked as moderately critical, 3 were marked as highly critical, and 1 was marked as extremely critical.

Fully-disclosed

Up

The following values only include vulnerabilities that had publicly known exploits or proof-of-concept exploit code before a patch was available, according to Secunia's advisories.

It should be noted that not all theoretical exploits hold the same likelihood of attack. Some vulnerabilities may have publicly available proof-of-concept code that is very difficult to exploit in practice. Criticality levels often provide some indication of the ease of exploitation, but they also represent the sheer potential impact of the flaw whether easily exploitable or not.

Security vulnerabilities (fully-disclosed)

Aspect	Internet Explorer	Firefox	Safari	Opera
Historical cumulative values (Product life)
Vulnerability reports	45	13	3	9
High severity vulnerability reports	17	2	2	1
Vulnerability issues	65	14	5	13
Relative danger	486	74	36	66
Historical cumulative values (from first 365 days)
Vulnerability reports	6	2	3	3
High severity vulnerability reports	1	0	2	1
Vulnerability issues	6	2	5	7
Relative danger	41	13	36	30
Historical cumulative values (from last 365 days)
Vulnerability reports	18	6	3	0
High severity vulnerability reports	0	0	2	0
Vulnerability issues	19	6	5	0
Relative danger	71	15	36	0
Highest values at one time
Vulnerability reports	15	7	2	2
High severity vulnerability reports	3	1	1	1
Vulnerability issues	16	7	3	6
Relative danger	107	31	20	25
Mean average per day (from last 365 days)
Vulnerability reports	14.23	2.56	1.05	0
High severity vulnerability reports	0	0	0.21	0
Vulnerability issues	15.23	2.56	2.01	0
Relative danger	52.88	5.73	6.7	0
Median average per day (from last 365 days)
Vulnerability reports	14	3	1	0
High severity vulnerability reports	0	0	0	0
Vulnerability issues	15	3	2	0
Relative danger	50	6	4	0
Present values
Vulnerability reports	15	2	1	0
High severity vulnerability reports	0	0	0	0
Vulnerability issues	16	2	2	0
Relative danger	59	5	4	0

Internet Explorer has had 45 fully-disclosed vulnerability reports. 6 were marked as moderately critical, 6 were marked as highly critical, and 11 were marked as extremely critical. There are still 15 remaining, including 4 that were marked as moderately critical.

Firefox has had 13 fully-disclosed vulnerability reports. 2 were marked as moderately critical, 2 were marked as highly critical, and 0 were marked as extremely critical. There are still 2 remaining, both of which were marked as less critical or not critical.

Safari has had 3 fully-disclosed vulnerability reports. 0 were marked as moderately critical, 2 were marked as highly critical, and 0 were marked as extremely critical. There is still 1 remaining, which was marked as less critical.

Opera has had 9 fully-disclosed vulnerability reports. 3 were marked as moderately critical, 0 were marked as highly critical, and 1 was marked as extremely critical. All of the reported vulnerabilities have since been fixed.

Patch delay

Up

It is also important to consider how quickly each web browser fixes its vulnerabilities. The following table lists the average time taken between Secunia's vulnerability reports and the release dates of their respective patches, if all aging unfixed vulnerabilities (vulnerabilities at least as old as the mean of all fixed vulnerabilities for that browser) were to be fixed today. Data does not include unfixed vulnerabilities less than that age, vulnerabilities with unknown fix dates, or vulnerabilities that were only publicly known after the patch release. Values listed are in days.

Patch delay (in days)

Average	Internet Explorer	Firefox	Safari	Opera
Per vulnerability report
Overall mean	693	186	69	76
Overall median	484	43	23	29
High severity mean	148	13	21	8
High severity median	53	10	21	8
Per vulnerability issue
Overall mean	588	172	79	118
Overall median	210	23	23	44
High severity mean	133	17	21	8
High severity median	65	23	23	8
Weighted by relative danger
Overall mean	523	162	49	65
Overall median	145	23	23	21
High severity mean	141	13	21	7
High severity median	53	10	21	1
Per fully-disclosed vulnerability report
Overall mean	505	187	69	77
Overall median	120	17	23	11
High severity mean	60	5	21	1
High severity median	50	5	21	1

Graphs

Up

The following graphs illustrate present security figures in each browser over time. The graphs span from February 9, 2004 to today.

← Back to Web Devout home

This work is copyright © 2008 David Hammond and is licensed under a Creative Commons Attribution Share-Alike License. It may be copied, modified, and distributed freely as long as it attributes the original author and maintains the original license. See the license for details.

• About Web Devout
• Privacy policy
• FAQ
• Blog
• Discussion
• Search
• Contact me