With Firefox 57, they're now essentially equivalent in terms of the security architecture. There's a small architectural difference with how tabs are sandboxed

With Firefox 57, they're now essentially equivalent in terms of the security architecture. There's a small architectural difference with how tabs are sandboxed against one another. That is, Chrome starts a new process for every tab, unless it's on the same domain as another tab. Firefox by default only uses as many processes for tabs as you have processor cores and then round-robins tabs across those. This achieves essentially equivalent parallelism with much lower resource usage, so overall better performance. If you'd rather have the security than the performance, you can set dom.ipc.processCount in about:config to a higher number. This is the maximum number of processes that it will use for tabs, so setting it to something like 1000 will essentially make it start a new process for each tab. Then there's something to be said about add-ons. Mozilla does manual code reviews of most extensions and extension updates. (They have some criteria for when they don't do a manual code review and instead just an automated check, based on how damaging the extension is able to be with the things that it accesses.) As a result, AMO has essentially no problems with malware, whereas on the Chrome Store you hear every other month of some trojan or adware spreading. Mozilla also has a policy that disallows telemetry without user opt-in as a whole, so recognizing adware or a trojan is just a matter of observing network traffic where it shouldn't necessarily be going. Lastly, Firefox Sync is end-to-end-encrypted by default, only one password needed. Chrome Sync is not, you need to set up a second password for it to be end-to-end-encrypted. And Google will store and work with your Sync data, if you do not opt for E2EE, so that's another possibility for a pretty big data leak. Not a problem, if you are security-conscious and don't mind setting up that secondary password, but recommending it to average users on the merits of it being secure is essentially out with this.