The biggest issue is that Firefox on Android runs all websites in the same process.

https://bugzilla.mozilla.org/show_bug.cgi?id=1565196

Another example, third party Chromium builds like Vanadium or Mulch also go further and enable CFI on Android (still default disabled upstream last I checked).

Chrome also has what, at least from the outside, looks like a little more refined mitigations for WebGL.

That said, both browsers have huge attack surfaces. The best you can do for any of them is to disable WebGL, WebRTC, WebUSB etc. completely and only enable the ones you need. This does much more for your security when browsing the web than the differences between browsers.

The plugins for Firefox to expose this functionality have at least traditionally been a little bit more user friendly.

Opt-in javascript functionality would be the next step.

I maintain configs for both to do just that!

https://gitlab.com/divested/brace/-/blob/master/brace/etc/ch...

https://gitlab.com/divested/brace/-/tree/master/brace/usr/li...