Safest browser in 2026? Chrome, Edge, Opera, Brave, Firefox and Safari by the numbers – three engines, 15 zero-days

You have six browser icons on your desktop. Chrome, Edge, Opera, Brave, Firefox, Safari. It feels like a supermarket shelf. The catch is that under the hood there are only three engines – and it’s the engine, not the logo, that decides whether someone takes over your laptop after you click a link. 💥

This year Google has already fixed seven Chrome holes that were actively exploited in attacks before anyone patched them. Every single one also sat in Edge, Opera and Brave, because it’s the same code. So the real question isn’t “which browser is the safest”, it’s “which engine, how fast it gets patched and by whom”. I ran the numbers for 2025 and 2026.

Three engines, or why “choosing a browser” is largely an illusion

The browser engine is the part that reads HTML, runs JavaScript and draws the page. In plain English: it gets handed code from a website you don’t know and has to run it without hurting you. Every browser exploit I know of targets exactly that.

And here’s a surprise for non-technical readers: there are three engines. Everything else is a skin, privacy settings and an address bar.

What does that mean in practice? When Google announces “an exploit for CVE-2026-xxxxx exists in the wild”, the same hole is sitting on the machines of eight out of ten internet users. Not just in Chrome. In Edge, in Opera, in Brave, in Samsung Internet on your mom’s phone and in every desktop app built on Electron (Slack, Teams, Discord, VS Code).

On the iPhone it gets even more interesting: “Chrome on iOS” is really WebKit with a Chrome logo, because until 2024 Apple didn’t allow other engines, and even after the changes the DMA forced in the EU, nobody actually shipped their own engine there. So iPhone = WebKit, period.

Lesson #1: comparing “Opera vs Brave” in terms of exploits is like comparing two paint jobs on the same car. The real question is how fast a given vendor passes Chromium patches on to you and what it adds on top.

Zero-days, or what is really under attack

A zero-day is a hole criminals exploit before the vendor ships a patch. For a browser it’s the worst-case scenario: you visit a page and someone runs code on your computer. No clicking “download”, no “run”.

In its annual report “Look What You Made Us Patch”, the Google Threat Intelligence Group counted 90 zero-days exploited in 2025 (78 in 2024, a record 100 in 2023). And here’s the important news: browsers accounted for only 8 of them, under 10% – a downward trend for the third year in a row. Attackers have moved to operating systems (39 zero-days) and edge devices and appliances (48% of all, a record). For the first time, more zero-days were attributed to commercial surveillance vendors (CSVs) than to state espionage groups.

Now let’s look at the individual engines.

Chrome: 15 zero-days in 21 months

Eight in 2025 and seven up to September 9, 2026. Almost all in the same place: V8, the JavaScript engine (type confusion, out-of-bounds, use-after-free), plus graphics (Skia, ANGLE, Dawn/WebGPU) and two sandbox escapes. Most were found by Google’s Threat Analysis Group, which tracks spyware vendors. The first zero-day of 2025 (CVE-2025-2783) was reported by Kaspersky – it was used in the “ForumTroll” espionage operation against Russian media and universities, and the attack started with a single click on a link in an email.

Does that mean Chrome is leaking like a sieve? No. It means it’s the biggest target in the world and at the same time has the most people detecting those attacks. If Firefox had 79% of the market, the same teams would be finding them in SpiderMonkey. For you as a Chromium user, it means one thing: your update cadence has to be weekly, because attackers don’t wait.

Safari and WebKit: few, but “extremely sophisticated”

Apple uses one stock phrase: “may have been exploited in an extremely sophisticated attack against specific targeted individuals”. That’s code for commercial spyware like Pegasus or Graphite. In 2025 we got three such WebKit patches, two of them at once in December – and CVE-2025-14174 is the same bug Google had patched in Chrome two days earlier (in the shared ANGLE library). March 2026 brought the “DarkSword” exploit kit, described simultaneously by iVerify, Lookout and Google TIG, and the August Safari 26.6.1 update closed 21 holes in WebKit alone.

The takeaway: Safari users show up in the stats less often, but when they do, it’s as the target of a state or mercenary spy. For an ordinary company the risk is low; for a lawyer, a journalist or a board member it’s a different story. That’s why Apple has Lockdown Mode, a mode that switches off parts of WebKit in exchange for security.

Firefox: least attacked doesn’t mean never attacked

SecurityWeek counted about a dozen Firefox holes exploited in attacks over the last decade. In March 2025, two days after Google, Mozilla patched CVE-2025-2857 – an identical bug pattern in IPC code that was being actively exploited in Chrome (Mozilla did not confirm attacks on Firefox). In May 2025 at Pwn2Own Berlin, two researchers broke Firefox (renderer, no sandbox escape) – Mozilla shipped a fix the same day. In July 2026 two bugs (CVE-2026-15718/15719) surfaced with a public exploit, but no attacks in the wild.

Paradoxically, a small market share is an advantage here: nobody invests in an exploit for 3% of the market when the same budget can buy 79%. The exception is Tor Browser (built on Firefox) – exploits do show up there, because the target is specific.

Lesson #2: the number of zero-days measures how attractive the target is and how vigilant the defenders are, not code quality. But the fact that your engine is target number one is something you have to live with – and the rest of this article follows from it.

CVEs: numbers almost everyone reads backwards

Every year the “most vulnerable browsers ranking” comes back on forums, built with a simple method: count the CVEs. Let’s do that, and then I’ll show you why this method finally died in 2026.

Chrome 149 and 150 together patched 1072 security bugs – more than the previous 23 releases combined. Since April 2026 Google has shipped over 1400 fixes. What happened? Google unleashed AI agents on its own code (Big Sleep from DeepMind and Project Zero, CodeMender), which comb through every change daily. The result: by March 2026 Google had received more reports than in all of 2025, in April it lowered bug bounty rates for simple bugs, and now it’s testing two security updates per week, because weekly can no longer keep up.

So here’s a question for the CVE-counting crowd: did Chrome become six times less secure in 2026 than in 2025? Of course not. It became six times more thoroughly searched. The CVE count measures how hard people are looking, not how many holes there are. Firefox with 187 CVEs isn’t “almost as vulnerable as Chrome” – it simply has an honest, public reporting process. And Safari with a few dozen CVEs isn’t three times better – Apple just says less, and later.

There is, however, one number that hasn’t changed in years and actually means something: around 70% of serious bugs in Chromium are memory safety bugs (use-after-free, buffer overflows) – classic C++ mistakes. GTIG calculated that in 2025, 35% of all exploited zero-days fell into exactly this category. That’s why all three are investing in the same thing: Firefox has been pulling in Rust for years, Chrome has MiraclePtr (turns use-after-free into a plain crash), the V8 Sandbox, and in 2026 moved its PNG decoder to Rust, while Apple introduced hardware Memory Integrity Enforcement in the iPhone 17.

Lesson #3: if someone sells you a browser with the slogan “we have the fewest CVEs”, ask how many people are looking for those CVEs. Silence in the NVD database more often means no audit than no bugs.

How fast they patch – the only metric I’d hang on the wall

A zero-day is the vendor’s problem. But from the moment a patch is published, the bug becomes an n-day, a hole the whole world already knows about, while you still haven’t patched it. Chromium is open source: the moment a fix lands in the repository, anyone can reverse it and write an exploit. That’s why speed is everything.

The best hard data came from Project Zero in a 2022 analysis (reports from 2019-2021): Chrome needed an average of 30 days from report to fix release, Firefox 38, WebKit 73. What was inside was more interesting: Chrome had the patch ready in code after about 5 days, and then it waited for release for most of those 30 days. Google drew the conclusion – since August 2023 (Chrome 116) security updates ship every week, which cut the “patch gap” of about 15 days by another 3.5 days. In 2026, as I wrote above, it’s piloting two per week.

Here’s how I see it on pentests: I scan the client’s network, pull browser versions from User-Agent headers and almost always find two or three machines running a browser that’s months old, because “someone hasn’t restarted since the summer holidays”. In the Chromium family, every such machine carries all of this year’s zero-days. I don’t need a million-dollar exploit then – I just wait for someone to click.

Lesson #4: in a company you don’t pick a “secure browser”. You pick the one you can enforce at the current version with policies (GPO/Intune/MDM) on every machine. For business that boils down to Chrome or Edge with an auto-update policy and a forced restart, or alternatively Firefox ESR.

How big is the security team? Nobody will tell you, but the wallet does

I looked for current figures and I’ll be honest: none of the three vendors publishes the size of its browser security team. The last public numbers are old (Chrome talked about around 20 engineers in 2013, Mozilla about around 80 people including volunteers in 2008) and mean nothing today. There are, however, three proxy indicators that do say something: how much they pay researchers, who finds their bugs and what happened to their people.

On Opera, let me add something I always tell clients: its patch delays are a technical problem you can count in days. But the fact that a browser with a built-in “VPN” (in practice a proxy) is two-thirds owned by a Beijing company is a question for your compliance team, not a pentester. Opera says the owner has no access to user data. I have no way to verify that – and that’s the whole answer.

Lesson #5: engine security is bought with money and openness. Google has the most of the first, Mozilla the most of the second, Apple has money and silence. The vendors on Chromium don’t have an engine – they have a stopwatch.

Where the money really gets lost: extensions and infostealers

Now a cold shower for everyone who made it this far to pick the “safest engine”. In my engagements I rarely see a browser exploit. What I see all the time is:

• Infostealers, malware that simply reads passwords, cookies and sessions saved in the browser. Flashpoint calculated that in the first half of 2025 they stole 1.8 billion credentials from 5.8 million devices, and over all of 2025 they infected more than 11 million devices. Verizon’s DBIR 2025 showed that 54% of ransomware victims had their domains appear in infostealer logs beforehand. An infostealer doesn’t need a zero-day. It needs you to install a “Photoshop crack”.
• Malicious extensions. In July 2025 Koi Security found 18 extensions in the Chrome and Edge stores (colors, VPN, emoji, “dark mode”), installed 2.3 million times, which quietly received a malicious update. Half a year earlier, phishing aimed at extension developers compromised dozens of extensions used by about 2.6 million people. The engine has nothing to do with it: an extension has official permission to read every page.
• Phishing and ClickFix, a page that tells you to paste something into a terminal. It works the same in Safari, Chrome and Firefox, because it attacks the human.

Lesson #6: your choice of engine decides whether someone takes over your computer without your help. Whether they take it over with your help is decided by policies: no saving passwords in the browser (use a password manager), an extension allowlist and MFA that can’t be stolen from a cookie.

Seven laws of browser security (2026 edition)

1. You don’t choose a browser, you choose an engine and a stopwatch. Blink, WebKit or Gecko – and who delivers your patches.
2. A browser from a month ago is a browser with a full set of this year’s zero-days. Automatic updates plus a forced restart are mandatory, not optional.
3. The CVE count measures auditing, not leakiness. 429 patches in Chrome 149 is good news.
4. A zero-day in Chrome is a zero-day in Edge, Opera, Brave and Teams. Check when your vendor delivered the fix.
5. If you’re a spyware target, use a hardened mode (Lockdown Mode in Safari, Enhanced Protection in Chrome, Edge with JIT disabled) and accept that some sites may work worse.
6. Extensions are code with permission to do everything. In a company: an allowlist or nothing.
7. Passwords in the browser are a gift for an infostealer. A password manager and phishing-resistant MFA (security keys/passkeys), because those can’t be carried off in a log.

Summary: what I would choose

As a pentester, not as a fan of any logo:

• Company, managed machines: Chrome or Edge with update policies – the most thoroughly researched engine, the fastest patches, the most management tooling. Firefox ESR if you want a second engine in the organization.
• Privacy and a “smaller target”: Firefox – fully aware that on some platforms its sandbox is less mature than Chromium’s and that Mozilla has a fraction of Google’s budget. Brave if you want tracking protection on a Chromium engine.
• Apple ecosystem: Safari, because you don’t have another engine on the iPhone anyway. For high-risk people: Lockdown Mode.
• What to avoid: browsers that lag behind on Chromium patches, anything past end of support and any browser where you keep passwords without MFA.

Most importantly: there’s no “safest browser 2026” ranking that would survive a week. There’s a rhythm: engine, patches, policies, people. If you want to check what that rhythm looks like in your company – from browser versions on your machines to whether your employees’ credentials are already circulating in infostealer logs – that’s exactly the kind of thing I check as part of my security testing. You can get a quote yourself with the calculator. ✔️

Sources

• StatCounter Global Stats – Browser Market Share (August/September 2026)
• Google Threat Intelligence Group – Look What You Made Us Patch: 2025 Zero-Days in Review
• BleepingComputer – Google patches seventh Chrome zero-day exploited in attacks this year (Sep 2026)
• BleepingComputer – Google says AI helped Chrome fix 1,072 security bugs in two releases
• SecurityWeek – Chrome 149 Patches 429 Vulnerabilities
• Project Zero – A walk through Project Zero metrics
• Google Security Blog – An update on Chrome Security Updates (weekly)
• Chromium Projects – Memory safety
• SecurityWeek – Google Paid Out $17 Million in Bug Bounty Rewards in 2025
• Security Affairs – Apple doubles maximum bug bounty to $2M
• The Hacker News – Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild
• TechRepublic – Apple’s 2026 Security Events (DarkSword, Background Security Improvements)
• Mozilla Security Blog – Firefox Security Response to pwn2own 2025
• SecurityWeek – Firefox Affected by Flaw Similar to Chrome Zero-Day Exploited in Russia
• Mozilla – Bug Bounty Hall of Fame
• ZDI – Pwn2Own Berlin 2025: Day Three Results
• ZDI – Pwn2Own Berlin 2026: Day Two Results
• Intego – 2nd Chrome zero-day patched in 5 days (Opera’s delays)
• Cyber Security News – Microsoft Edge Fixes Actively Exploited Chromium Vulnerability (CVE-2025-6554)
• stack.watch – Chrome, Firefox, Safari – CVE counts by year (NVD)
• SecurityWeek – Infostealers Turn Millions of Devices Into Credential Theft Machines (Flashpoint)
• BleepingComputer – Malicious Chrome extensions with 1.7M installs found on Web Store (Koi Security)
• Wikipedia – Opera (company) and SEC Schedule 13D/A, Opera Ltd (2026)