Firefox Tops Vulnerability List

[Osiris]

Firefox Tops Vulnerability List

A new study has come out today that threatens to rain on Firefox’s 5th birthday parade. The report claims that Firefox leads the pack with vulnerabilities (44%), Safari came in second (35%), Internet Explorer was third (15%) and Opera ranked the best (6%).

According to Cenzic, Firefox accounted for 44 percent of all browser vulnerabilities reported in the first half of 2009. In contrast, Apple's Safari had 35 percent of all reported browser vulnerability, Microsoft's Internet Explorer was third at 15 percent and Opera had just six percent share.

[Trotter]

Excerpts from the article:

As to why Firefox's numbers were so high, Cenzic has a few ideas.

"It's a combination of different things," Lars Ewe, CTO of Cenzic, told InternetNews.com. "They've gotten more traction as a browser, which is good for them and the more you get used the more exposure you have. As well a fair amount of the vulnerabilities have come by way of plug-ins."

One key area that Ewe said was responsible for a number of reported Firefox vulnerabilities is with how the browser handles plug-ins.

"The plug-in architecture that they have is a selling fact for the browser and one of the reasons why I love using it," Ewe said. "They can't control security aspects of all the plug-ins and the vulnerabilities are a side effect of that."

Mozilla has made numerous efforts this year to bolster its plug-in security. Recently they launched a plug-in checker service to ensure that users are running up-to-date versions. The Firefox 3.0.9 update, which came out in April, specifically addressed several key plug-in vulnerabilities.

Though Firefox had the highest number of vulnerabilities, that doesn't necessarily mean that Firefox users were more vulnerable.

Ewe said that Cenzic looked at all reported vulnerabilities. There is no specific differentiation for zero day bugs in the browser vulnerability count either. All that raises the question of how Cenzic actually came up with their vulnerability counts in the first place.

"The process that we follow is looking at a number of different vulnerability databases and sources that we have and trying to come up with a fair percentage based on the deviations we see between the databases," Ewe said. "You could make the argument, that's its 40 percent or 42 percent and there might be some variation on how you analyze it, but certainly it's not off by 20 percent."

Dude made some good points, but also pointed out the "why" behind the numbers. That's the price you pay for gaining market share. At least with Firefox being open source people are active in not only finding the problems but in fixing them as well.

[KSoD]

The thing i am sure most people will be surprised with is the numbers for IE. 2nd best? That will be a tough pill for people to swallow. But honestly Ie8 has made great strides. Almost enough to get me back using it.

[Trotter]

"Almost"?

I will admit that I was surprised by that bit of info.

[KSoD]

Yes almost. Sadly Firefox is not my top browser either. I have been using Chrome more. As it uses far less resources than Firefox with the same amount of tabs and it works with the sites i need. Opera isnt even installed this time. Shocking for me to say the least...