Would someone who actually _knows_ the answer (I know this will not deter the HN-reckon but worth a try) be able to comment on if/why this security gap exists?

Is it something fundamental to the different design choices, is it just which has had more test/resources thrown at it, and is the closing of the gap practical and/or on a roadmap?

The Chrome multiprocess isolation model is really good. Firefox devs have known this for ages (heck, there were demos of a version of Firefox 3.x with a similar model), but could not actually land this model for two reasons:

- it would break all old-style extensions and users were unhappy about that;

- it takes looooots of memory and users were unhappy about that, too.

Now that Firefox has dropped all old-style extensions, there's large focus on reducing memory footprint, to allow moving to this model without costing as much memory as Chrome.

There are still a few kinks to fix, but this new isolation model should hopefully land within a few months.

Also, all sorts of security improvements are much easier now that Firefox dropped old-style extensions. Also, switching many developments to Rust makes new code much, much safer.

Also, Firefox isolates the browser UI and Web content into separate processes now. So that all the code you download from the internet doesn't run in the browser process. Same is with plugins.

A browser written in Rust (which is probably Firefox's long term goal) should blow Chrome out of the water in terms of security, despite the massive efforts invested in that regard by Google to prop up Chrome's C++ code base.

Would it really though? Sure, there are definitely things about Rust that make coding more secure, but surely that it only one part of security?

Indeed, that's only one part of security. But it's a pretty big one!

Definitely, it prevents the buffer overflow style of exploits but there’s also a lot of leaks in how all the DOM objects interact.

It seems unlikely that FF will ever be completely written in Rust. More likely that new bits that get added are Rust, and many of the old bits stay C++.

If FF gets rewritten in Rust, it will be a decades long effort.

I would just add that Mozilla also targets security critical portions with Rust rewrites. You don't necessarily need 100% Rust to be secure (if you have the right security model).

Google doesn’t have military grade static analysis that rejects anything that could allow buffer overflow attacks?

No, they don't, because such a thing cannot exist for C++. Any attempt would basically recreate Rust, or something equivalently incompatible with existing C++ codebases.

I know of at least one design choice that resulted in Chrome preferring security vs. Firefox preferring privacy: when exactly to persist HSTS information. https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-bro...

In some ways. This is the same browser that doesn't (or "didn't"? It's been a while since I've looked) do CLR-based certificate revocation checks because Google didn't like the standard, but will black list specific revoked test certificates to make it look like they do (Verisign had a test site for a while with a revoked cert). To be fair, they are right: CLRs are sometimes huge and downloading them is a pain, but they're still the standard and Chrome decided it didn't want to use them.

So then OCSP comes along and everything will be fine now, right? Nope, Chrome doesn't (or, again, "didn't", they might have fixed this since I last looked, but that doesn't make it any better) let you do any sort strict revocation checking, so if the OCSP response failed and a response wasn't pinned, Chrome would happily let you in without bothering to check revocation (Firefox does this by default too, annoyingly, but it does have a strict mode).

Even if these things have been fixed, Chrome's general attitude towards web standards and security is to run away and not bother when they don't get their way, so even if you're not already skeptical of blanket claims that they're "more secure", which is a meaningless thing to say, there is evidence that their attitude towards web security might make them less so.

Updated to mention "malware"

Ungoogled-chromium exists you know..