Hacker News Reader

Chromium is a magnitude more secure than Firefox. If you find a 0day in the Firefox renderer, bam, code execution with full user permissions. A 0day in Chromium renderer code is pretty much worthless.

Firefox has zero additional layers of security. Chromium has a battle-tested sandbox which kills 99% of all exploits in the absence of an additional kernel exploit.

Also note how none of the recent Flash 0days was exploitable on Chrome.

"developers of the Tor browser" probably not, lots of incompetent people in infosec. Tor itself has decent devs, but even they have seen leadership troubles recently, pressure from feds etc. Check the mailing-list.

Reminder, this isn't a vulnerability in Tor, but an IP leak in Firefox, or at least the way it's configured in TBB.

Maybe a sandbox is irrelevant to an IP leak though, idk.

chromium still has a sandbox

And mystery binary blobs have made an appearance[0]

[0] https://www.reddit.com/r/linux/comments/3a0rz0/chromium_unco...

Distros can choose to disable that feature. Also note that the blob runs _inside_ the sandbox.