Modern web browsers expose an enormous attack surface with a gazillion parsers written in C and C++. They are also constant targets due to marketshare and ease/flexibility of payload delivery.

Emacs is written mostly in Emacs Lisp, a memory safe language. So security implications come down to either logic bugs, the C parts of Emacs or the C libraries, usually parsers, that Emacs links with (e.g. ImageMagick which should never be enabled by security-conscious folks and GnuTLS which Emacs supports using out-of-process and security-conscious folks that need it should do so).

Let's look at some published vulnerability statistics.

Google Chrome: > 550 total, 121 remotely exploitable code execution, 450+ memory corruption/overflows (potentially exploitable).

Emacs: 0 unassisted remotely exploitable code exec vulnerabilities, 2 assisted ones (CVE-2017-14482, CVE-2012-3479). Finally, note how specific to exact requirements the Emacs vulnerabilities are. You had to either read an email sent to you containing the payload or open a plain text file with the payload embedded in it and clearly visible.

[1] https://www.cvedetails.com/vulnerability-list/vendor_id-72/p...

[2] https://www.cvedetails.com/product/15031/Google-Chrome.html?...