> (most people only update chrome every month, so it only hits 1/30 users). What do you base that on? My understanding is that a system with Chrome installed

> (most people only update chrome every month, so it only hits 1/30 users). What do you base that on? My understanding is that a system with Chrome installed will check for updates every 5 hours[0], and I assume most people accept the update on the day that they see it is available. > The problem on google chrome would be easier to detect, because it wouldn't be able to pinpoint a specific user. I'm also not clear what you mean here. An attacker could decide to target a victim by their IP address, or any detail about their computer which is available to Chrome. I agree with you though about native applications being able to do more damage, and possibly persisting on a machine for longer. > Apps on phones are more secure because a malicious binary can't stop itself being removed via Apple / Google's app stores. On the other hand, the user isn't secure against threats from the app stores themselves, not least the threat to Availability when an app store uses a kill switch to delete an app without warning.[1] [0] https://support.google.com/chrome/a/answer/6350036?hl=en https://support.google.com/chrome/a/answer/6350036?hl=en [1] https://www.macworld.com/article/191897/iphone_killswitch.html https://www.macworld.com/article/191897/iphone_killswitch.ht...