4 ms·

This is the second time I've seen the reference to Chrome being the most secure browser. What's that based on?

landr0id 8y ago
Exploit prices and complexity usually accurately reflect the security of a product when compared to their competitors. Take a look at how much Zerodium pays for full-chain exploits here: https://zerodium.com/program.html https://zerodium.com/program.html $250,000 - Chrome RCE + SBX (Windows) including a sandbox escape (previously: $150,000) Whereas it's up to $100k for Edge RCE+SBX, $80k for Firefox RCE+SBX You obviously need to factor in other things such as how popular the product is compared to competitors, etc., but such a drastic price difference such as this is quite telling.
- faltad 8y ago
  You have a valid point but you are using misleading data: Don't compare a RCE + SBX vs a RCE w/o SBX. Firefox RCE + SBX is 80k, edge is 100k, safari is also 80k. Another thing to take in consideration is the number of people that the exploit could be used against. For example, following this: http://gs.statcounter.com/browser-market-share/desktop/worldwide http://gs.statcounter.com/browser-market-share/desktop/world..., Chrome would have almost 68% of the browsing share whereas Firefox is only close to 10% and all the others even less. It'd be surprising this isn't taken account by Zerodium in their price calculations!
  - landr0id 8y ago
    You're correct -- I was referring to the table that was easiest to quickly reference which is the changelog, not ALL current prices. The periodic table is more accurate. I'll update my post.
- throwawaymath 8y ago
  Adding to this comment, see prices for 2018's Pwn2Own contest [1], for which Google Chrome has a 50% premium over Firefox and Safari. The Chromium bug bounty [2] is also the most accessible in terms of documentation and requirements; likewise it has the lowest floor and highest ceiling on potential payouts. ______________________ 1. https://www.zerodayinitiative.com/Pwn2Own2018Rules.html https://www.zerodayinitiative.com/Pwn2Own2018Rules.html 2. https://www.google.com/about/appsecurity/chrome-rewards/ https://www.google.com/about/appsecurity/chrome-rewards/

Exploit prices and complexity usually accurately reflect the security of a product when compared to their competitors. Take a look at how much Zerodium pays for full-chain exploits here: https://zerodium.com/program.html https://zerodium.com/program.html $250,000 - Chrome RCE + SBX (Windows) including a sandbox escape (previously: $150,000) Whereas it's up to $100k for Edge RCE+SBX, $80k for Firefox RCE+SBX You obviously need to factor in other things such as how popular the product is compared to competitors, etc., but such a drastic price difference such as this is quite telling.

faltad 8y ago
You have a valid point but you are using misleading data: Don't compare a RCE + SBX vs a RCE w/o SBX. Firefox RCE + SBX is 80k, edge is 100k, safari is also 80k. Another thing to take in consideration is the number of people that the exploit could be used against. For example, following this: http://gs.statcounter.com/browser-market-share/desktop/worldwide http://gs.statcounter.com/browser-market-share/desktop/world..., Chrome would have almost 68% of the browsing share whereas Firefox is only close to 10% and all the others even less. It'd be surprising this isn't taken account by Zerodium in their price calculations!
- landr0id 8y ago
  You're correct -- I was referring to the table that was easiest to quickly reference which is the changelog, not ALL current prices. The periodic table is more accurate. I'll update my post.
throwawaymath 8y ago
Adding to this comment, see prices for 2018's Pwn2Own contest [1], for which Google Chrome has a 50% premium over Firefox and Safari. The Chromium bug bounty [2] is also the most accessible in terms of documentation and requirements; likewise it has the lowest floor and highest ceiling on potential payouts. ______________________ 1. https://www.zerodayinitiative.com/Pwn2Own2018Rules.html https://www.zerodayinitiative.com/Pwn2Own2018Rules.html 2. https://www.google.com/about/appsecurity/chrome-rewards/ https://www.google.com/about/appsecurity/chrome-rewards/