Chrome, Pitted

As Google's Chrome web browser increased in popularity from 2008, there was a correlated increase in potential customer exposure.  The graph below illustrates the rise of disclosed vulnerabilities in Chrome linked to market share (as reported by W3Schools).

 
 

From 2008 to November 2010 Chrome experienced a 1,154% increase in discovered vulnerabilities, far outstripping the rate of discovered vulnerabilities in other emergent browsers such as Firefox (at 594%) by almost a factor of 2.

The graph suggests that weaknesses in software do not appear to dampen customer demand. Chrome market share increased despite an explosion in discovered security defects.

Resilient software is not part of market competition; it is highly decoupled from other competitive variables and thus emergent products tend to under-supply software security without fearing customer backlash. Customers cannot "see" insecurity and thus cannot accurately price associated risks prior to acquisition.

This is a distortion in the market that should be corrected.

Comments

[Bradarkin]

Hey David,

The problem with using reported CVE count is that it isn't a good proxy for how secure a product is. My guess is the Google bug bounty program and the rising popularity of the browser account for a lot of the increase. Also, how are CVEs in bundled components like webkit, etc. counted in the CVE stats?

Chrome's security has actually gotten quite a bit better in the past two years despite the increase in CVE count. The fact that no one has bothered to target Chrome in the pwn2own contest the past couple years feels like an indicator that it is more difficult to attack than the frequent browser victims of the contest such as Safari.

Security may not be a key factor users consider when selecting their browser, but I don't think Chrome supports your argument in this case.

Brad

[Joeri]

Also, firefox 1.0 was merely an evolution of the mozilla engine, and chrome is based on webkit. It's difficult to define a "zero" point for these browsers, since there hasn't been a new general-purpose browser engine made in over a decade.