GrapheneOS recomienda no usar Firefox por ser POCO SEGURO

Avoid Gecko-based browsers like Firefox as they're currently much more vulnerable to exploitation and inherently add a huge amount of attack surface. Gecko doesn't have a WebView implementation (GeckoView is not a WebView implementation), so it has to be used alongside the Chromium-based WebView rather than instead of Chromium, which means having the remote attack surface of two separate browser engines instead of only one. Firefox / Gecko also bypass or cripple a fair bit of the upstream and GrapheneOS hardening work for apps. Worst of all, Firefox does not have internal sandboxing on Android. This is despite the fact that Chromium semantic sandbox layer on Android is implemented via the OS isolatedProcess feature, which is a very easy to use boolean property for app service processes to provide strong isolation with only the ability to communicate with the app running them via the standard service API. Even in the desktop version, Firefox's sandbox is still substantially weaker (especially on Linux) and lacks full support for isolating sites from each other rather than only containing content as a whole. The sandbox has been gradually improving on the desktop but it isn't happening for their Android browser yet.

Firefox sandbox is much weaker than Chromium on desktop Linux. The main difference is that Firefox doesn't have completed site isolation so it only defends the overall OS from compromise rather than properly defending sites and browser data from sites. They're working on it...

The main improvement Firefox was working on which Chromium wasn't was porting code to Rust, but Mozilla laid off most of the people doing it. Rust and Servo aren't Mozilla projects anymore. Firefox's efforts on this largely stalled and now they have a lot of redundant code.

Rust doesn't have all the basic exploit mitigations implemented so using only a bit of it creates some more weaknesses for the C++ code. Firefox doesn't deploy basic mitigations like type-based CFI anyway. Since it doesn't even use Clang CFI yet, it really says a lot about it.

Similarly far less JIT hardening in Firefox. One of the major differences is that Chromium has a massive level of fuzzing, auditing, etc. compared to Firefox. Google also monitors for in the wild exploits so they get often caught to both fix the bugs and learn from the exploits.

They probably don't catch the majority of exploits used in the wild but they catch enough to regularly learn from how attackers are actually exploiting the browser and then implement defenses against the real world attacks. Mozilla gave up on doing those kinds of things.

Bear in mind Mozilla laid off tons of their security people and most people working on Rust. They got rid of a ton of not just browser security people but infrastructure security. They're more focused on trying to use stuff like AI or privacy-respecting advertising in Firefox.

If Google gets forced to stop paying money to Mozilla to be the default search engine, that could be the beginning of the end of things for Mozilla. Bear in mind nearly all their funding comes from Google and that's currently in jeopardy. Bing might pay but likely not as much.

Google is likely going to be forced to stop paying them. They're likely going to have to settle for a much lower, much less competitive bid from Microsoft. Maybe Microsoft feels like being generous to them, but they have Edge and Firefox doesn't have much usage share anymore.

Microsoft could just let Firefox die and get a lot of the market share for Edge. Windows desktop is where most of the Firefox users are and a lot would probably just go to Brave, Edge, etc. Microsoft may benefit more not giving them a new massive source of funding.

Edge has a ton of monetization in it for Microsoft, not just them being the default search engine. It also regularly asks to reset back to Bing, etc. after major updates to optimize your experience or however they spin. They get people to switch to Edge in the same way.

Cita de Morya

Ah, lo dice el del sistema del pixel que es de Google. Y seguro que Chrome es el mejor jajaja