# Assessing Browser Security: A Detailed Study Based on CVE Metrics
## 3 Materials and Methods
### Estimating the Browser Threat Indices  
To assess browser security based on CVE metrics, it is essential to define the key parameters used in this evaluation. The following parameters were selected:  
1. Browser Popularity-Represents the percentage of users relying on a specific browser. More widely used browsers may attract more attackers due to their larger potential attack surface. 2. Number of CVE Vulneribilities--Indicates the total number of documented security vulnerabilities associated with the browser, reflecting its historical security posture. 3. CVSS Score--Measures the severity of vulnerabilities, providing insight into how critical and exploitable these weaknesses are. 4. EPSS Score--Estimates the likelihood of a vulnerability being exploited in real-world attacks, offering a predictive risk assessment. To compare browsers according to their vulnerabilities and CVSS data, a direct comparison may not be precise due to the differing popularity of web browsers. If a browser is more popular, then more users utilize it, and as a result, more users can fall victim to cyberattacks [23]. Looking at the data without an accurate comparison may lead to a false conclusion that Google Chrome is the most vulnerable browser because it has the largest number of vulnerabilities. To determine the correct conclusion about browser security, it is important not only to include the number of vulnerabilities and CVSS scores but also to factor in the popularity of browsers in the comparison. The idea is based on estimating a vulnerability index--the ratio between the number of vulnerabilities and the browser's population, which could be expressed as Formula (1):  
\[I_{\text{CVE}}=\sum_{t=f}^{l}\frac{V_{t}}{P_{t}} \tag{1}\]  
where:  
* \(I_{\text{CVE}}\)--CVE browser threat index for certain year;\(t\)--year;
* \(f\)--first year;
* \(l\)--last year;
* \(V_{t}\)--the amount of browser vulnerabilities per year;
* \(P_{t}\)--average browser's popularity per year in percentage. By summing up the ratio between the number of vulnerabilities and the average popularity for each year, the vulnerability index could be calculated for each year. The CVE Details database can already present the average CVSS score for a selected period. However, to compare browsers via CVSS more precisely, the score should be divided by the average browser popularity by year, as indicated in developed Formula (2):  
\[I_{CVSS}=\frac{C_{avg}}{\left(\sum_{t=f}^{l}P_{t}\right)/(l-t)} \tag{2}\]  
where:  
* \(I_{CVSS}\)--CVSS browser threat index;
* \(t\)--year;
* \(f\)--first year;
* \(l\)--last year;
* \(C_{avg}\)--average browser's CVSS score for the selected period;
* \(P_{t}\)--average browser's popularity per year in percentage. Unlike the previous index, \(I_{CVE}\), the average popularity per year was chosen to maintain scalability due to the available average CVSS score, which is represented as an average score. The browser threats, which are categorized by type and impact, differ and have varying CVSS and EPSS scores. Since CVSS indicates the severity of a vulnerability and EPSS reflects the probability of its exploitation, the multiplication of CVSS and EPSS can be used to identify risk [24], as represented in developed Formula (3):  
\[R_{t}=\sum_{t=f}^{l}\sum_{i=1}^{n_{t}}(C_{t,i}\times E_{t,i}) \tag{3}\]  
where:  
* \(R_{t}\)--risk of all browser threats for a selected year based on CVSS and EPSS scores;
* \(t\)--year;
* \(f\)--first year;
* \(l\)--last year;
* \(E_{t,i}\)--the amount of browser's vulnerabilities per year and type, impact;
* \(C_{t,i}\)--CVSS score for selected vulnerability per year according to it type and impact. To estimate browser threats more accurately, the combination of the number of vulnerabilities, EPSS, and the CVSS score for each should be considered in relation to the browser's popularity, as was previously carried out for the \(I_{CVE}\) and \(I_{CVSS}\) indices.