> The lines get blurry. Is a modern browser a feature upgrade or security?

A modern browser should be a feature upgrade. A browser as modern as the one that came with the device, except without known security issues, should be a required security update.

Coincidentally no one develops the latter without the former, so you get the former, but I don't see that you are entitled to it.

If anything I think the law should be designed such that there's an argument that you are entitled to the version of the browser that came with your device with security updates and without any feature regressions, which is never available today since browsers do choose to remove features on a regular basis.

Replying to myself here, one interesting result of the "security updates without any feature regressions" interpretation is that it would be a very strong disincentive to bundling software. You would want to let users install their own browser instead, so that every browser feature isn't a feature that you need to maintain. It seems like it could completely eliminate shipping with apps like Facebook pre-installed, because Facebook is never going to commit to not removing features.

It's probably not feasible with todays software ecosystem to actually create that constraint... but I still really like the idea.

I like the idea.

Often when apps like Facebook are bundled on lower-end Android phones, they are not uninstallable. This means they take internal memory and can't even be moved to SD cards, severely restricting the functionality and durability of those phones. The only way way to fix it is by rooting.

Non-essential or third party apps should be at least un-installable. I'd be ok with a law for that.

> But if the vendors really would just sort of fix their old mobile browser, you would still be stuck with a old browser unable to interact with the modern web.

This is a non-problem nowadays. We have long left the times in which browsers received essential features every few weeks. Using a browser with a feature set from five years ago you can still use all the most-visited websites perfectly fine. At the worst you're unable to use small, non-essential features of some sites. Maybe some ads look less fancy ;-)

Your problem today as a browser user is security against zero-interaction exploits, not missing out on some obscure brand-new CSS features. Security updates are thus what you need first and foremost.

Browser APIs are less stable than you might think. If you've ever had to develop web apps for smart TVs (Samsung, LG, Vizio, etc.), then you'll find that each model year is frozen on an old version of Chromium – some from 2016, some from 2017, some from 2018, etc. There are enough differences between them to make this painful. For example: multiple versions of the Media Source Extensions API, web components, CSS variables, ES6 modules, and web font loading patterns.

Wasm is becoming a thing.

With updates needed.

A browser is an application, one of which you can have multiple versions installed (even so modern OS vendors try to prevent that). If the system default browser in Android/iOS has a vulnerability, that should be patched. No one forces you to install the latest version of that browser as a security mitigation.