Google Experiment Tests Top 5 Browsers, Finds Safari Riddled With Security Bugs (bleepingcomputer.com)

An anonymous reader writes from a report via Bleeping Computer: The Project Zero team at Google has created a new tool for testing browser DOM engines and has unleashed it on today's top five browsers, finding most bugs in Apple's Safari. Results showed that Safari had by far the worst DOM engine, with 17 new bugs discovered after Fratric's test. Second was Edge with 6, then IE and Firefox with 4, and last was Chrome with only 2 new issues. The tests were carried out with a new fuzzing tool created by Google engineers named Domato, also open-sourced on GitHub. This is the third fuzzing tool Google creates and releases into open-source after OSS-Fuzz and syzkaller. Researchers focused on testing DOM engines for vulnerabilities because they expect them to be the next target for browser exploitation after Flash reaches end-of-life in 2020.

Comments

Not suprising

[Billly Gates]

Safari is Apple's IE 6 of this decade. It hasn't been updated in a long time and they can no longer piggy back both Google and Konqueror for new code since Chrome forked -webkit with -blink.

I worked for a famous software supporting their cloud software. Safari was the one browser which always had trouble with even drag and dropping files. Something rudimentary in the HTML 5 standard. Even IE 9 from 2011 can easily support this.

Sometimes Safari would work. Sometimes it would not and the Apple users always get mad at us for some reason never blaming their shitty browser.

Re:Not suprising

[Anonymous Coward]

I my college posts warnings on the course webpages: "We are incompetent and can’t build a website correctly."

Fixes that far you. Safari is the only web browser that isn’t a complete piece of shit.

Re: Not suprising

[Old97]

Funny because I also use Safari and I run Adblock - right now in fact. There are tons of extensions and privacy features. The ad industry is up in arms about the latest Safari feature - no allowing the ad networks to track you across different web sites. I suspect you don't use Safari at all because you don't know anything about it. Do you work for Google or Microsoft?

Re:Simple Fix

[Anonymous Coward]

It's not that simple. Try using Google without JS.

Actually, google search works ok without javascript. Google mail still has a basic lite mode too. The rest of google won't work without javascript.

There are tons of other sites with the same problem.

Yes, and they are badly written. Compare to amazon - it works with any browser, with or without javascript, because amazon knows you won't buy if their website won't work in the customer's browser.

Re:What an impartial study!

[mangastudent]

Fuzzers are pretty impartial, and I don't find it hard to believe that the Chromium/Chrome team is the best at security.

Re:I take it we're all supposed to know...

[hord]

DOM = Document Object Model

The DOM engine is what is responsible for parsing HTML/CSS, converting it into a tree, and then rendering the tree to the client area in the browser. It's essentially the core of the browser and presents a programmatic API along with JavaScript. It may also be used to render UI elements. For example, all of Chrome's plugins use HTML/CSS to create the menus you see in the options and menu screens.

Re:no surprise about safari

[dgatwood]

Is there a corporation that forces people to run Safari?

Apple. On iOS, all browsers (even Chrome) are actually running Safari's rendering engine, with the exception of browsers that run all the JavaScript server-side. The reason for this is that Apple won't let apps run non-Apple JavaScript engines out of concerns about security. (The irony here is not lost on me.)