You have your online banking open in one tab. In another is a site you reached through an advert, and you have no idea it is malicious. Whether that site can get at your bank depends on how well your browser keeps the two apart.
Search for advice on which browser to use and most of what comes back is about privacy: who tracks you, and which browser blocks the most trackers. Security gets far less attention. You have to go looking in the specialist corners of the web to find anyone comparing how well browsers keep attackers out, and that is the question this series sets out to answer.
People mix the two up all the time. Privacy is about who gets to see what you do. Security is about whether someone can break in and take over. A browser can be good at one and mediocre at the other.
Why This Matters Beyond the Security Crowd
The web is full of malware, and making it keeps getting cheaper. In February 2026 Google’s threat intelligence team reported attackers using AI to “create super-realistic phishing scams and develop malware” (Google). A convincing fake website or a poisoned download page no longer needs a skilled team behind it.
A lot of it reaches people through adverts. In December 2024 Microsoft traced a campaign that most likely started on illegal streaming sites, where adverts inside the video players sent visitors through a chain of redirects to malware stored on GitHub. It affected nearly a million devices, at home and at work, and its main job was stealing information (Microsoft).
Your browser is what stands between those pages and everything else on your computer.
Walls Between Websites
Back to the banking tab. If the browser runs both sites in the same process, sharing the same slice of memory, a flaw in the browser can let the malicious page read what the bank’s page holds.
This has happened. In 2018 the Spectre flaw in computer processors showed that a web page could read memory it was never meant to see. Google’s answer was Site Isolation, switched on for every desktop Chrome user in July 2018: each website gets its own process, and the operating system keeps them apart (Google Security Blog). Firefox built its own version, called Fission, and it reached all desktop users with Firefox 95 at the end of 2021 (Mozilla).
These walls are the feature I care about most when choosing a browser, and they are where the engines differ most.
Add-ons
Plenty of people load their browser with add-ons, Chrome users above all. Each one slows the browser a little, and each one is a piece of software that can see the pages you visit.
On Christmas Eve 2024 an attacker phished an employee at Cyberhaven, a data security company, and used the stolen access to publish a malicious version of its Chrome add-on. For just over a day it copied login cookies and access tokens, mostly for Facebook business accounts, from every browser that updated. The add-on had more than 400,000 users, and it was one of more than 25 add-ons hit in the same campaign, with 2.3 million users between them (LayerX).
Firefox’s add-on store is not immune. In 2025 researchers at Koi Security found more than 40 fake crypto wallet add-ons there, posing as Coinbase, MetaMask and other wallets and secretly collecting the details needed to empty them (The Block).
Only Two Browsers
Google Chrome, Microsoft Edge, Brave, Vivaldi and Opera look different and come from different companies. Underneath, they are all built on Chromium, the open-source project Google runs and builds Chrome from. When I say Chrome in this series, I mean that whole family.
Firefox is the only serious alternative with an engine of its own. Safari has the other, and it runs only on Apple devices. There are one or two more engines out there, but they are too niche to be worth your time yet.
Sharing one engine cuts both ways. Chromium has the strongest walls between websites and the most money spent hunting its flaws, because Google pays for it. A serious flaw in Chromium also hits most of the world’s browsers at once. In February 2026 Google patched the first Chrome flaw of the year that attackers were already using, and Edge, Brave, Opera and Vivaldi users were told to install their own updates as soon as they arrived (Security Affairs).
Firefox stands outside that. A Chromium flaw does not touch it, and the reverse holds too. In October 2024 a Russia-aligned group called RomCom chained a Firefox flaw with one in Windows to install a backdoor on the computers of people who did nothing more than visit a booby-trapped website (ESET). Chrome users were never at risk from it.
| What matters | Chromium family | Firefox |
|---|---|---|
| Walls between websites | Strongest | Good, younger |
| Extra locks on the riskiest parts | Many | Fewer |
| Security fixes | Chrome first, the rest soon after | Every four weeks, plus emergencies |
| Paid flaw hunting | Google’s large budget | Smaller budget |
| Attacks aimed at it | Most | Fewer |
| Dangerous-site warnings | On by default | On by default |
| Full-strength advert blocking | Brave only | Yes |
| Add-ons | More restricted | More powerful |
| One flaw hits many browsers | Yes | No |
Phones Are Different
On an iPhone in the UK, every browser has to use Apple’s engine, the one inside Safari. Install Firefox or Chrome and you get their look and features wrapped around Safari’s engine. Apple now allows other engines in the EU and Japan, but no major browser has shipped one yet.
On Android it depends on whose Android you have. A phone running Samsung’s or Xiaomi’s version behaves differently from one running a de-Googled system such as /e/OS, LineageOS or GrapheneOS. GrapheneOS, which you can install on Google’s Pixel phones, comes with Vanadium: a hardened version of Chromium that, by default, talks only to GrapheneOS’s own servers (GrapheneOS). GrapheneOS is known for strict security, and it is also easy to use.
What the Series Covers
- Windows 11: Chrome, Edge, Brave and Firefox. Windows 11 is the only version of Windows you should be running. If your computer cannot upgrade, consider moving to Linux.
- Mac: Safari joins the comparison.
- Linux: Linux comes in many flavours, with many ways to install software, and how you install a browser matters almost as much as which one you pick.
- iPhone: five browsers, one engine.
- Android: Chrome, Edge, Brave and Firefox, plus Vanadium on GrapheneOS.
The Bottom Line
Whichever browser you pick, you are choosing between two engines, or three on Apple devices. Chromium has the stronger walls and the faster fixes, and it is the one most attackers aim at. Firefox has weaker walls but sits outside the damage when Chromium breaks, and it still lets you block malicious adverts at full strength. The right choice depends on your device, and the next five posts take each one in turn.
What’s Your Experience?
Did security come into your choice of browser at all, or did you use whatever came with the computer? Tell me through social media.
If you look after the computers in a small business and want a second opinion on which browser to standardise on, book a call and we can talk it through.
Photo by rc.xyz NFT gallery on Unsplash
