A Firefox zero-day vulnerability

Firefox is an order of magnitude larger, a lot more complex, and takes at least 15 times as many different forms of input (HTML, XHTML, CSS, JavaScript, SVG, MathML, JPEG, PNG, GIF, ICO, Vorbis, Theora, VP8, WAV, SMIL) as a mailserver. All those forms of input have complicated specs. It has 400 million installs, and deals with people's sensitive financial information, and is therefore a very tempting target for hackers.

In addition, number of vulnerabilities is a much worse measure of risk than "days of vulnerability" - how many days in a year users of that software are vulnerable to a critical bug, before a fix is provided. In 2006 (no-one has done the study since that I can find), it was Firefox: 9, IE: 286.

1 vulnerability is 1 too many, but you could at least try and compare apples with apples. :-)

Gerv