Malware generally can't just "hijack" any arbitrary browser. You have to have exploits for a specific browser / browser family / JS engine. Chromium has defense

Malware generally can't just "hijack" any arbitrary browser. You have to have exploits for a specific browser / browser family / JS engine. Chromium has defense in depth techniques to try to raise the difficulty bar and to try to limit the fallout of an exploit in various parts of the tech stack, but that still requires a Chrome-specific attack in the first place. Attacks for Safari / WebKit / JavascriptCore would similarly require a different vector for the exploit (even if some techniques are common, the specific details should be quite different). There is a newer class of generic malware that exploits CPU bugs (e.g. Spectre) - are you perhaps referring to that? If so, that's a fair concern but unlikely to matter much in practice. For Spectre itself, I believe the mitigations were applied within the major JS engines directly (or at least for v8 they were). Anyway, security issues are best compared when there's a lot more attention to your browser. But given that there's a huge amount of exploits that depend on buffer overflows that are simply impossible in the first place with Rust, it's likely that the browser's likely to mostly suffer only from architectural issues & fewer implementation issues whereas other browsers will still have architectural issues and implementation issues to boot that prevent them from addressing it. Yes, newer browser = likely more immature architecture, but at the same time there's fewer implementation issues to worry about in terms of exploiting architectural issues in the first place.