The honeymoon for Firefox may well be over. Now that so many people
have the browser, new versions of malware are targeting Mozilla just
like IE. In fact, documentation shows that Mozilla software has not
been THAT much safer than IE - some, but not a lot and that lead is
shrinking fast.
Here is an excerpt from Symantec's latest Internet Security Threat Report:
Vulnerabilities affecting new alternative browser distributions
Historically, most of the exploits targeting Web browser vulnerabilities
have been directed at Microsoft® Internet Explorer, the most widely used
Web browser. In response to this, many people in the Internet
community have turned to browsers such as Mozilla, Mozilla Firefox,
Opera, and Safari as more secure alternatives. However, as
security-conscious users have migrated away from Internet Explorer,
attackers have followed suit. In response to the changing browser
landscape, this volume of the Internet Security Threat Report Symantec
is including an analysis of vulnerabilities in different browsers.
The discovery of vulnerabilities affecting browsers appears to be on the
rise (figure 3), with more Mozilla vulnerabilities documented in this
period than those affecting Microsoft Internet Explorer. This runs
contrary to a trend seen in previous periods where nearly all browser
vulnerabilities affected Microsoft Internet Explorer exclusively.
Between July 1 and December 31, 2004, Symantec documented 13
vulnerabilities affecting Microsoft Internet Explorer. This is notably
lower than the 21 vulnerabilities affecting each of the Mozilla browsers
that were documented during the same period. Six vulnerabilities were
reported in Opera and none in Safari.
Though the share of vulnerabilities affecting the Mozilla browsers has
increased, Microsoft Internet Explorer still has a greater proportion of
high-severity vulnerabilities. Of the 13 vulnerabilities affecting
Microsoft Internet Explorer documented by Symantec this period, nine
were considered high severity. Of the 21 vulnerabilities affecting the
Mozilla browsers, 11 were classified as high severity, while only seven
affecting Firefox were highly severe. While there have been few, if any
credible reports of attacks against Mozilla, Mozilla Firefox, Opera, or
Safari in the wild, it remains to be seen whether these browsers will
live up to the expectations that many have for them.