Kinda? Yes. Though probably not at that exact scale, but I also never said Mozilla has Google’s pipeline, or what Mozilla shoulda, coulda, woulda done. I was talking about an acceptable security baseline. Mozilla is also using advanced fuzzing, static analysis, and AI assisted vulnerability discovery, so Google is not the only browser company using newer technology to find security flaws. 423 security bugs in April alone is nothing to sneeze at.
1,072 is not a cross browser security score. Google is counting security fixes across the broader Chrome codebase after introducing a new bulk scanning system. And it’s own post says that system found a sandbox escape that had survived for more than 13 years, and says that a sudden increase in bugs found and fixed is not evidence of failure.
The accounting is also different. Chrome’s totals cover a big ass range of components and products, while Mozilla sometimes consolidates multiple memory safety bugs under a single cve. Unless the numbers are normalized for scope and exploitability and counting method, comparing “1,072” with Mozilla’s advisory count tells us very little.
It shows that Google currently has greater bug discovery and remediation. That is not by itself show that Firefox falls below an acceptable security baseline.