General understanding of browser security

Clap2Grom673

Hello, because I have a very basic question about browser security.

I understand that browser security is very important but I don't understand the following:

What is the (exact) attack surface? What could possibly happen if my browser is insecure and why? And what is the difference between gecko and chrome based browsers in this sense?

Can someone describe this in practice terms?
Like: "Say you use browser blablabla and visit site blablabla, if blablabla then blablabla ..."

Like, if I research some person on wikipedia, what is the best way to go?
And, if I log in to my student acc at my uni network/my work acc at my work network, what is the best way to go then?

other8026

Clap2Grom673 you can start off by reading this section of the website: https://grapheneos.org/usage#web-browsing. It covers a lot of what you're asking.

Phead

Clap2Grom673

In my opinion it's important to understand at least why someone is claiming browser A is more secure than browser B rather than understanding the technicalities behind it.

Here is a good read: https://madaidans-insecurities.github.io/firefox-chromium.html

Probably, most of it does not make any sense to you if you haven't heard of sandboxing and other related topics before. And that's fine. Read it anyway. Follow some of the links to his claims and see for yourself. You don't have to understand how sandboxing is implemented to understand that you're better off with more security features than with less.

In practice terms: when EvilScript64 on evil website[.]com makes use of a vulnerability in your gecko based browser, it's possible that the adversary gains controll over your OS. Very broken down to if A then B. With proper sandboxing the adversary is confined to the sandbox and cannot harm your system, kind of like a cage.

lambd

Clap2Grom673 What is the (exact) attack surface? What could possibly happen if my browser is insecure and why?

Browsers execute JavaScript (and nowadays WebAssembly also) code that can be malicious. A browser vulnerability can be used into an exploit chain to end with privileged system access.

Sandboxing is a huge security feature to minimize the potential of exploit chain. That is why Chromium browsers are better as of now.
Another new huge security feature is ARM Memory Tagging Extension to minimize memory corruption. That is why Vanadium is better as of now.

Clap2Grom673

other8026
Thanks for your answer. The problem is that it isn't written in "practice terms" and I can barely understand it...

[deleted]

Clap2Grom673 the above mentioned link is your flight plan and your general guide for web browsing, how it is applied is entirely upon you and no one is going to tailor it to your needs, that is your job to do.

other8026

Clap2Grom673 Basically, Chromium browsers have better site isolation (via sandboxing) than Gecko-based browsers (no sandboxing), so if you're concerned about that, then use a Chromium browser instead of Firefox or other Gecko-based browsers.

Basically, you can use Vanadium for all of your browsing. That's what I do. If you want more bells and whistles, you can try another Chromium-based browser, but they're unlikely to be as hardened as Vanadium.

The only real exception would if you want to browse using Tor. In that case, use the Tor Browser.

mmmm

[deleted] I think they were more saying they didn’t understand the parlance, rather than asking how to apply it.

Clap2Grom673

mmmm yeah, right! Thank u

Clap2Grom673

Phead thanks, that really helped!