{'fraction_non_alphanumeric': 0.011475409836065573, 'fraction_numerical': 0.0, 'mean_word_length': 5.3264248704663215, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Critical Vulnerability in Browser Security Metrics

Every time a browser vendor releases a patch for a critical vulnerability, the popular news media publishes a slew of negative press article detailing the security holes that have been announced in the product. Users who read these articles often decide to switch to a “safer” browser. The negative press associated with security patch releases has a number of unhealthy effects on the industry. We challenge the conventional wisdom of the current browser security evaluation paradigm: that browsers that receive infrequent security patches are safer than browsers that receive frequent patches, that browsers with a lower bug count are safer, and that reducing browser vulnerabilities is the only path that a browser vendor can follow to improve security. We argue that patch deployment matters vastly more than patch frequency, that bug count fails to take into account differences in severity and vendor reporting methodologies, and that the security features that matter most are ignored by negative news articles. We propose methods for evaluating browser security that take into account new industry best practices such as silent patch deployment and sandboxing.