The issues have nothing to do with the differences between STL smart pointers and Mozilla/Chromium smart pointers.
They are '90s codebases, they're not just "like" '90s codebases. Firefox obviously dates back to Netscape, and webkit (which Safari, Chromium, Opera, Vivaldi, and now Edge are based on) is a fork of KHTML.
Mozilla could have achieved 90% of what it wanted from a rust rewrite with a modern C++11 rewrite at a quarter of the cost. Linter rules that say "no new or delete", "either unique_ptr<T> or shared_ptr<const T>", and "only construct unique or shared ptr via make_unique and make_shared" get them like three quarters of the way there.
The thing that makes rust great is that the static analyzer is built into the compiler and has strict defaults. C++ is the same language, but clang-analyze and clang-tidy are shipped as separate packages and have more permissive defaults.
Those rules are completely insufficient. It's worth looking at the actual vulnerabilities here.
There is a reasonable argument that modern C++ is less safe than old C++, because features like lambdas are very prone to use-after-free.
- raw mallocs : https://github.com/mozilla/gecko/blob/central/dom/plugins/ip...
- new / delete : https://github.com/mozilla/gecko/blob/central/dom/plugins/ip...
- "whatever.Allocate<T>" : https://github.com/mozilla/gecko/blob/central/dom/plugins/ip...
and that's not limited to a single file... look at this :
https://github.com/mozilla/gecko/blob/3e6d6e013400af38f85ceb... - some malloc and new, again
- you also get some unique_ptr (because "modern" m'see) : https://github.com/mozilla/gecko/blob/3e6d6e013400af38f85ceb...
- moz_xmalloc because why not ? https://github.com/mozilla/gecko/blob/3e6d6e013400af38f85ceb...
- oh and did you know about our own custom reference counting pointer ? https://github.com/mozilla/gecko/blob/3e6d6e013400af38f85ceb...
etc etc... when you've got 35 different ways to allocate objects used willy-nilly of course things go wrong. Most modern codebases only ever use automatic storage, and unique / shared_ptr.