Browser security beyond sandboxing

So far I'd say it's pretty clear the stronger isolation model works better than the multiple-mitigation techniques model, even though Edge actually has some relatively strong sandboxing, too, which makes the ineffectiveness of its mitigation mechanisms even worse.

Also, as they say in this post, Google is already developing an even stronger isolation model that would have prevented this type of attack. It's just not fully tested and enabled yet.

Finally, Google seems to dedicate more people for patching Chrome, or at least it has a system that fixes bugs much faster than Microsoft does in Windows. One of Edge's main weaknesses is that it essentially works as a part of Windows, not as a third-party app. This is something I've criticized them for since when they first announced Edge and said this was a mistake precisely because of this reason, of being tied to Windows updates, and thus slower to improve.

I don't really care about the part where they're supposed to wait for Google to fix it or whatever. I don't know the details for this, but I believe Google waits on some bugs for 90 days and on some highly-critical ones, like bugs being exploited in the wild only 7 days. But I suppose that's also a pretty arbitrary number, so I don't know if I should be upset at Microsoft for releasing the bug sooner than that.

All in all, it's actually pretty cool that Microsoft and Google are attacking each others' products like this. It keeps both on their toes, at least I would hope it does. I just wanted to point out that Microsoft is being rather misleading in this post when it's implying that Edge's model has better security. Chrome's security is not bulletproof but it seems to have proven itself to be quite good so far.

It's also why I was hoping Mozilla wouldn't make those "best of both worlds" compromises between sandboxing and saving 30% memory. Is saving 30% memory worth having your browser twice as exploitable? Maybe it won't be that exploitable, so we'll see. Firefox may also be able to make up for the weaker sandboxing with the Rust rewrites, but only time will tell.

However, I don't care at all about elevated privileges. If a bug in my browser allows code executing, that means that code is executing with my privileges. So all my data is already at risk. And my data is basically the only thing that's important. Becoming part of a botnet or the propagator of virusses is annoying at worst. Ransomware or my data leaking out is infinitely worse.

And Edge seems to exceptionally horrible at preventing code execution. Perhaps their security team should focus on that for a bit.