Is Firefox More Secure?

Firefox Security Hole on Vista

The recent ANI (animated cursor) exploit that has been talked about so much in security and tech forums was first believed to affect only Internet Explorer V7. Firefox fans wagged their fingers at IE users once again and chided them for not switching to the "more secure" Firefox. But it turns out that Firefox is also vulnerable to this very serious exploit on Windows Vista systems. And even worse, the bug is potentially MORE destructive on Firefox than with IE7.

That's because Firefox does not support Protected Mode in Windows Vista -- a feature that can prevent malware from modifying or deleting your data. It may be a small consolation, but Protected Mode limits rogue programs to a read-only mode of access to your hard drive. Without Protected Mode, viruses, spyware and other nasties can do much more damage when they gain access to your system. Protected Mode is crucial to security, but Mozilla (the developers of Firefox) won't even say if or when they will add support for it.

George Ou, in his Real World IT column says "I have asked Mozilla PR and its developers many times if and when it intends to support Protected Mode, and I have yet to receive an answer. This is unfortunate because Firefox alone in recent months has had more exploits than Windows XP and Vista combined and is in serious need of mitigation measures, not to mention better code auditing... If Mozilla ever wants Firefox to be taken seriously, it's going to need to do better auditing of its code and implement security measures that are available in the operating system."

And this isn't just about the ANI flaw. As recently as March 6th, a batch of Firefox security fixes rated Highly Critical was released. The batch addressed multiple vulnerabilities which, according to the Secunia security advisory, "can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting and spoofing attacks, gain knowledge of sensitive information, and potentially compromise a user's system."

I don't say any of this to diss Firefox. On the contrary, I use it every day and prefer it over IE7. But that's because of it's flexibility, not because I think it's more secure. Do you have comments or questions about Firefox security? Post your thoughts below...