And just in case folks aren't super familiar with Cure53, they know their stuff. The report largely speaks for itself in conveying their level savvy on browser

And just in case folks aren't super familiar with Cure53, they know their stuff. The report largely speaks for itself in conveying their level savvy on browser security. Google didn't hire some corporate consulting firm that would give them a glowing recommendation based on a review by folks not knowledgeable enough to really be able to differentiate between browser security architectures. P.S. We (GitHub) have engaged Cure53 several times, including an assessment dedicated to Content Security Policy bypasses across various browser implementations. Mario (and team) are incredible to collaborate with.