The two remaining browser engines are of course very important here, but there is a large number of other libraries and software that uses those libraries (in d

The two remaining browser engines are of course very important here, but there is a large number of other libraries and software that uses those libraries (in different configurations, and all with their particular bugs) as well. E.g. openssl didn't have a good name validation API (or any such API at all) for a long time, and a few years back I saw a ton of software which rolled their own stuff. I'd guess a lot of that code is still in production.