Web browser security summary

Table of Contents

1. Vulnerabilities
2. Publicly disclosed without a patch
3. Fully-disclosed
4. Patch delay
5. Graphs
   1. Total vulnerabilities
   2. Fully-disclosed vulnerabilities

Vulnerabilities

Up

The following table details the number of vulnerabilities and relative danger.

Historical cumulative values are provided in three forms: for all vulnerabilities in the entire of life of these products, for all vulnerabilities that were present within the first 365 days of the first vulnerability reported in the product, and for all vulnerabilities that were present within the last 365 days.

“High severity” values include vulnerability reports that were marked as “highly critical” and above. Relative danger levels are calculated by adding up the square of the criticality levels for each vulnerability report (not critical=1², extremely critical=5²).

A vulnerability is considered unfixed if the vulnerability report does not have a complete vendor patch.

Notice: Since Internet Explorer 7 was released, Secunia has not indicated which previously known unfixed Internet Explorer 6 vulnerabilities have been re-tested in IE 7, aside from the most recent few (which, by the way, were confirmed to still affect the new version). Secunia has a history of not listing very old vulnerabilities under new versions even if they still apply, and this is as true with Firefox and Opera as is assumed with Internet Explorer. Until Secunia updates the old advisories with an indication of the status in IE 7, this page will assume they still exist.

Notice: Safari for Windows is still fairly new, so there isn't much data yet. The current figures may not be particularly representative of the overall product.

Security vulnerabilities

Aspect	Internet Explorer	Firefox	Safari	Opera
Historical cumulative values (Product life)
Vulnerability reports	137	75	5	69
High severity vulnerability reports	63	29	4	21
Vulnerability issues	267	254	10	97
Relative danger	1507	707	68	613
Historical cumulative values (from first 365 days)
Vulnerability reports	31	20	5	18
High severity vulnerability reports	13	2	4	4
Vulnerability issues	69	39	10	23
Relative danger	331	156	68	138
Historical cumulative values (from last 365 days)
Vulnerability reports	45	19	5	10
High severity vulnerability reports	5	8	4	7
Vulnerability issues	56	62	10	28
Relative danger	256	167	68	129
Highest values at one time
Vulnerability reports	39	9	2	4
High severity vulnerability reports	5	2	1	1
Vulnerability issues	41	13	3	8
Relative danger	204	44	20	27
Mean average per day (from last 365 days)
Vulnerability reports	38.3	5.77	1.04	0
High severity vulnerability reports	1	0.1	0.17	0
Vulnerability issues	40.3	6.77	2.01	0
Relative danger	165.82	21.3	6.2	0
Median average per day (from last 365 days)
Vulnerability reports	39	6	1	0
High severity vulnerability reports	1	0	0	0
Vulnerability issues	41	7	2	0
Relative danger	170	20	4	0
Present values
Vulnerability reports	39	7	1	0
High severity vulnerability reports	1	0	0	0
Vulnerability issues	41	8	2	0
Relative danger	170	21	4	0

Internet Explorer has had 137 vulnerability reports. 25 were marked as moderately critical, 48 were marked as highly critical, and 15 were marked as extremely critical. There are still 39 remaining, including 10 that were marked as moderately critical and 1 that was marked as highly critical.

Firefox has had 75 vulnerability reports. 19 were marked as moderately critical, 29 were marked as highly critical, and 0 were marked as extremely critical. There are still 7 remaining, including 1 that was marked as moderately critical.

Safari has had 5 vulnerability reports. 0 were marked as moderately critical, 4 were marked as highly critical, and 0 were marked as extremely critical. There is still 1 remaining, which was marked as less critical.

Opera has had 69 vulnerability reports. 20 were marked as moderately critical, 20 were marked as highly critical, and 1 was marked as extremely critical. All of the reported vulnerabilities have since been fixed.

Publicly disclosed without a patch

Up

Many vulnerabilities are discovered by the browser vendors and patched before they are ever publicly known. Vulnerabilities are most dangerous when they are found elsewhere with no patch available. The following are historical cumulative vulnerability values that only include those vulnerabilities that were publicly known before a patch was available.

Security vulnerabilities (in public)

Aspect	Internet Explorer	Firefox	Safari	Opera
Historical cumulative values (Product life)
Vulnerability reports	96	42	3	30
High severity vulnerability reports	28	7	2	4
Vulnerability issues	126	54	5	35
Relative danger	867	271	36	212
Historical cumulative values (from first 365 days)
Vulnerability reports	22	14	3	14
High severity vulnerability reports	5	1	2	3
Vulnerability issues	31	17	5	19
Relative danger	185	100	36	105
Historical cumulative values (from last 365 days)
Vulnerability reports	40	11	3	0
High severity vulnerability reports	1	1	2	0
Vulnerability issues	42	12	5	0
Relative danger	174	46	36	0

Internet Explorer has had 96 reports of vulnerabilities discovered in the public without a patch. 21 were marked as moderately critical, 17 were marked as highly critical, and 11 were marked as extremely critical.

Firefox has had 42 reports of vulnerabilities discovered in the public without a patch. 11 were marked as moderately critical, 7 were marked as highly critical, and 0 were marked as extremely critical.

Safari has had 3 reports of vulnerabilities discovered in the public without a patch. 0 were marked as moderately critical, 2 were marked as highly critical, and 0 were marked as extremely critical.

Opera has had 30 reports of vulnerabilities discovered in the public without a patch. 10 were marked as moderately critical, 3 were marked as highly critical, and 1 was marked as extremely critical.

Fully-disclosed

Up

The following values only include vulnerabilities that had publicly known exploits or proof-of-concept exploit code before a patch was available, according to Secunia's advisories.

It should be noted that not all theoretical exploits hold the same likelihood of attack. Some vulnerabilities may have publicly available proof-of-concept code that is very difficult to exploit in practice. Criticality levels often provide some indication of the ease of exploitation, but they also represent the sheer potential impact of the flaw whether easily exploitable or not.

Security vulnerabilities (fully-disclosed)

Aspect	Internet Explorer	Firefox	Safari	Opera
Historical cumulative values (Product life)
Vulnerability reports	45	14	3	9
High severity vulnerability reports	17	2	2	1
Vulnerability issues	65	15	5	13
Relative danger	486	75	36	66
Historical cumulative values (from first 365 days)
Vulnerability reports	6	2	3	3
High severity vulnerability reports	1	0	2	1
Vulnerability issues	6	2	5	7
Relative danger	41	13	36	30
Historical cumulative values (from last 365 days)
Vulnerability reports	16	5	3	0
High severity vulnerability reports	0	0	2	0
Vulnerability issues	17	5	5	0
Relative danger	63	11	36	0
Highest values at one time
Vulnerability reports	15	7	2	2
High severity vulnerability reports	3	1	1	1
Vulnerability issues	16	7	3	6
Relative danger	107	31	20	25
Mean average per day (from last 365 days)
Vulnerability reports	14.57	2.48	1.04	0
High severity vulnerability reports	0	0	0.17	0
Vulnerability issues	15.57	2.48	2.01	0
Relative danger	55.09	5.48	6.2	0
Median average per day (from last 365 days)
Vulnerability reports	15	2	1	0
High severity vulnerability reports	0	0	0	0
Vulnerability issues	16	2	2	0
Relative danger	59	5	4	0
Present values
Vulnerability reports	15	3	1	0
High severity vulnerability reports	0	0	0	0
Vulnerability issues	16	3	2	0
Relative danger	59	6	4	0

Internet Explorer has had 45 fully-disclosed vulnerability reports. 6 were marked as moderately critical, 6 were marked as highly critical, and 11 were marked as extremely critical. There are still 15 remaining, including 4 that were marked as moderately critical.

Firefox has had 14 fully-disclosed vulnerability reports. 2 were marked as moderately critical, 2 were marked as highly critical, and 0 were marked as extremely critical. There are still 3 remaining, all of which were marked as less critical or not critical.

Safari has had 3 fully-disclosed vulnerability reports. 0 were marked as moderately critical, 2 were marked as highly critical, and 0 were marked as extremely critical. There is still 1 remaining, which was marked as less critical.

Opera has had 9 fully-disclosed vulnerability reports. 3 were marked as moderately critical, 0 were marked as highly critical, and 1 was marked as extremely critical. All of the reported vulnerabilities have since been fixed.

Patch delay

Up

It is also important to consider how quickly each web browser fixes its vulnerabilities. The following table lists the average time taken between Secunia's vulnerability reports and the release dates of their respective patches, if all aging unfixed vulnerabilities (vulnerabilities at least as old as the mean of all fixed vulnerabilities for that browser) were to be fixed today. Data does not include unfixed vulnerabilities less than that age, vulnerabilities with unknown fix dates, or vulnerabilities that were only publicly known after the patch release. Values listed are in days.

Patch delay (in days)

Average	Internet Explorer	Firefox	Safari	Opera
Per vulnerability report
Overall mean	709	192	84	76
Overall median	525	43	23	29
High severity mean	150	13	21	8
High severity median	53	10	21	8
Per vulnerability issue
Overall mean	602	177	97	118
Overall median	210	23	23	44
High severity mean	134	17	21	8
High severity median	65	23	23	8
Weighted by relative danger
Overall mean	534	167	58	65
Overall median	147	23	23	21
High severity mean	143	13	21	7
High severity median	53	10	21	1
Per fully-disclosed vulnerability report
Overall mean	523	182	84	77
Overall median	134	27	23	11
High severity mean	60	5	21	1
High severity median	50	5	21	1

Graphs

Up

The following graphs illustrate present security figures in each browser over time. The graphs span from February 9, 2004 to today.

← Back to Web Devout home

This work is copyright © 2008 David Hammond and is licensed under a Creative Commons Attribution Share-Alike License. It may be copied, modified, and distributed freely as long as it attributes the original author and maintains the original license. See the license for details.

• About Web Devout
• Privacy policy
• FAQ
• Blog
• Discussion
• Search
• Contact me