No, I don't think it's loading up a full browser - I think it's sending an HTTP request and then parsing the results to some degree. To whatever extent the HTTP

No, I don't think it's loading up a full browser - I think it's sending an HTTP request and then parsing the results to some degree. To whatever extent the HTTP request mechanism is secure, and the parsing mechanism is secure, it's secure. But you don't need a browser to have security holes - anything parsing random data from the internet could be a vector. That said, I agree - parsing the QR code itself isn't really a vector I'd worry much about.