# Assessing Browser Security: A Detailed Study Based on CVE Metrics
## 2 Related Works  
[PERSON] and [PERSON], in their article, investigated the security vulnerabilities of popular web browsers [16]. Firstly, they defined the common vulnerabilities in the most-used web browsers, such as SQL injection, cross-site scripting (XSS), sensitive file disclosure, cross-site request forgery (CSRF), and inadequate transport layer protection. They chose six web browsers for testing, including Google Chrome, Safari, Mozilla Firefox, Microsoft Edge, Opera, and Internet Explorer. On these six web browsers, they performed three different tests: the ACID3 test, which checks how well an internet browser adheres to certain web standards, particularly those related to the Document Object Model and JavaScript; a browser speed test; and a browser security test using an online tool and performing around 400 tests. In conclusion, they stated that Mozilla Firefox is the safest of all, passing a total of 370 tests. Safari and Internet Explorer showed no CSS or JavaScript vulnerabilities as identified by the ACID3 test. According to the speed test, Google Chrome is the fastest browser of all. [PERSON], in her article, conducted a security analysis of the most-used browsers that provide access to cyberspace [17]. She analyzed three web browsers--Google Chrome, Safari, and Mozilla Firefox--as the most popular. As a source for analysis, she used the CVE and CVSS databases for the period 1989-2021. According to her results, Google Chrome has the highest percentage of moderate 6-7 and 4-5 CVSS vulnerabilities, Firefox has the highest percentage of critical 9+ CVSS vulnerabilities, and Safari has the highest percentage of moderate CVSS vulnerabilities. In conclusion, she found that all browsers are not fully secure, and due to constant technological innovations, the better browser is the one that can consistently provide updates to enhance security. [PERSON] et al. investigated the architecture of modern web browsers to determine their security vulnerabilities [18]. Going deeper into browser architectures, they divided them into monolithic and modular browser architectures. In comparison to monolithic architecture, modular architecture is superior in terms of user experience, fault tolerance, accountability, security, memory management, and performance. In modular architecture, the performance of each program can be easily monitored, making it superior in accountability. In their study, they investigated the architecture of four browsers--Google Chrome, OP, Tahoma, and Gazelle--which are based on modular browser architecture. The analysis showed that the modular architecture of Chrome mitigates the most serious threats related to system compromise and data theft. However, Chrome's architecture does not provide full protection. Threats related to cross-site attacks, session hijacking, and user interface compromise are not fully mitigated. They also reviewed similar architectures implemented in the OP, Tahoma, and Gazelle web browsers. These architectures sacrifice compatibility with the current web architecture to provide a higher level of security than Chrome. The research was conducted in 2010, and since that time, only Chrome still exists, despite its lower security compared to the other three browsers in their study. [PERSON] et al., in their paper, presented a quantitative characterization of browser threats that can be used to project the number of vulnerabilities and plan, test, and develop resources more efficiently [19]. For their experiments, they chose three major browsers: Internet Explorer, Firefox, and Mozilla. They classified the vulnerabilities into eight categories, including Input Validation Error, Access Validation Error, Exceptional Condition Error, Environmental Error, Configuration Error, Race Condition Error, Design Error, and Others. They determined the percentage of each vulnerability category relative to the total browser threats. For each category, they calculated the chi-square goodness of fit.