3 ms·
In some ways. This is the same browser that doesn't (or "didn't"? It's been a while since I've looked) do CLR-based certificate revocation checks because Google
by SamWhited 8y ago
In some ways. This is the same browser that doesn't (or "didn't"? It's been a while since I've looked) do CLR-based certificate revocation checks because Google didn't like the standard, but will black list specific revoked test certificates to make it look like they do (Verisign had a test site for a while with a revoked cert). To be fair, they are right: CLRs are sometimes huge and downloading them is a pain, but they're still the standard and Chrome decided it didn't want to use them.
So then OCSP comes along and everything will be fine now, right? Nope, Chrome doesn't (or, again, "didn't", they might have fixed this since I last looked, but that doesn't make it any better) let you do any sort strict revocation checking, so if the OCSP response failed and a response wasn't pinned, Chrome would happily let you in without bothering to check revocation (Firefox does this by default too, annoyingly, but it does have a strict mode).
Even if these things have been fixed, Chrome's general attitude towards web standards and security is to run away and not bother when they don't get their way, so even if you're not already skeptical of blanket claims that they're "more secure", which is a meaningless thing to say, there is evidence that their attitude towards web security might make them less so.