Comparing CVE counts is a bit nonsensical. For instance, Chrome and Firefox don't individually assign CVEs for internally reported vulnerabilities.

For instance, in these patch notes Chrome lists "Various fixes from internal audits, fuzzing and other initiatives" and doesn't even look to have a CVE:

https://chromereleases.googleblog.com/2022/05/stable-channel...

Or for Firefox, there's a dozen or so bundled together in a single CVE under "Memory safety bugs fixed in Firefox 101":

https://www.mozilla.org/en-US/security/advisories/mfsa2022-2...