Browsers compared for security: Chrome, Firefox, Safari, Edge and Brave

Your browser talks to more untrusted code than any other program on your computer. Every page runs scripts written by strangers, so the browser's job is to update fast, keep sites apart and warn you before you land on a known scam. Chrome, Firefox, Safari, Edge and Brave all do this reasonably well. They differ in their defaults, in what the vendor learns about you and in how much room extensions get.

What we compared

We scored the five browsers on seven criteria, with higher always better. The scores are an editorial judgement based on vendor documentation as of October 2026 and refer to the desktop versions unless we say otherwise.

• Update speed: how quickly security fixes reach you.
• Isolation: sandboxing and keeping sites in separate processes.
• Tracking protection by default: what is blocked without changing settings.
• Content blocking: how capable blocking tools are, built in or through extensions.
• Malicious site warnings: protection against known phishing and malware sites.
• Vendor data restraint: how little the vendor collects about your browsing.
• Enterprise management: policies and central administration for organisations.

Interactive comparison

Browsers compared for security

Five desktop browsers scored from 1 to 5 on updates, isolation, privacy defaults, blocking, warnings, vendor data and management; higher is always better.

What matters to you?

Update speedHow quickly security fixes reach users.

Normal

IsolationSandboxing and documented separation of sites into their own processes.

Normal

Tracking protection by defaultWhat is blocked without changing any settings.

Normal

Content blockingHow capable blocking tools are, built in or through extensions.

Normal

Malicious site warningsProtection against known phishing and malware sites.

Normal

Vendor data restraintHow little the vendor collects about your browsing by default.

Normal

Enterprise managementPolicies and central administration for organisations.

Normal

Reset weights

1. Brave4.1
2. Firefox4.0
3. Chrome3.7
4. Edge3.7
5. Safari3.3

All scores in a table

Criterion	Brave	Firefox	Chrome	Edge	Safari
Update speed
Isolation
Tracking protection by default
Content blocking
Malicious site warnings
Vendor data restraint
Enterprise management

Editorial assessment as of 31 October 2026. Scores from 1 to 5, higher is better. Your weights only change the order.

Updates and isolation

Chrome moved from a four-week to a two-week cycle for major releases in September 2026, starting with Chrome 153, and Google had already been shipping security fixes weekly since 2023. Edge and Brave are built on Chromium, inherit its fixes and ship them on their own schedules. Firefox publishes a major release about every four weeks with security updates in between. Safari is updated together with macOS and iOS, so a Safari fix reaches you only as quickly as you install system updates.

All five run web content in sandboxed processes with limited rights on the operating system. Chrome and the other Chromium browsers also keep sites apart in separate processes on desktop, a technique called site isolation, and Firefox does the same with the architecture it developed as Project Fission. This limits what a compromised page can read from another site's memory. Apple publishes less detail on how strictly Safari separates individual sites, which is why we score it a little lower here, not because of a known weakness.

Tracking protection and data collection

Defaults differ most here. Brave blocks ads and trackers by default through Shields, which are built into the browser rather than added as an extension. Safari's Intelligent Tracking Prevention is on by default and limits third-party cookies and data. Firefox enables Enhanced Tracking Protection and, since 2022, Total Cookie Protection for all desktop users, which gives each site its own cookie jar. Edge runs tracking prevention in Balanced mode by default, which blocks trackers from sites you never engage with. Chrome blocks the least without changes to its settings.

Every vendor collects some data. Google and Microsoft run large advertising and account ecosystems, and signing in to the browser with sync switched on links your history and settings to that account. Mozilla and Brave collect usage statistics too, which you can switch off. Brave also ships optional extras such as its rewards programme and a crypto wallet, code you may not need. Apple ties Safari sync to your Apple Account. Open each browser's privacy settings once and switch off what you do not use.

Extensions and Manifest V3

Extensions are the most common way to weaken a well-configured browser, because they run with permissions you granted once and then forgot. Manifest V3 is the current extension platform of the Chromium project. It removes the ability of extensions to intercept and block network requests in code and replaces it with declarative rules. Google presents this as better for security and performance; it also makes powerful content blockers less capable.

Chrome has completed the switch. Manifest V2 extensions were disabled with Chrome 138, stopped working with Chrome 139, and the remaining ones were removed from the Chrome Web Store at the end of August 2026. Edge is moving more slowly: Microsoft's timeline shows deprecation warnings from September 2026 and enterprise deprecation expected to begin in early 2027. Brave hosts four Manifest V2 extensions itself (uBlock Origin, AdGuard, NoScript and uMatrix) on a best-effort basis. Firefox supports Manifest V3 but has said it has no plans to drop Manifest V2, and it keeps the blocking request feature that content blockers rely on. Safari extensions come through the App Store, which narrows the choice and adds Apple's review.

Warnings against malicious sites

Chrome and Firefox use Google Safe Browsing to warn before known phishing and malware sites, and Brave relies on Google's lists as well. Safari's fraudulent website warning may send information derived from the web address to Google Safe Browsing and Apple to check a site. Edge uses Microsoft Defender SmartScreen and offers a hardening mode, called Enhance your security on the web, that turns off the JavaScript just-in-time compiler on sites you rarely visit to reduce the attack surface. Chrome's Enhanced protection gives faster, real-time checks in exchange for sending more data to Google.

Enterprise management

For organisations, central policy matters as much as defaults. Chrome and Edge offer the deepest management, with hundreds of policies through Group Policy, cloud consoles and, for Edge, Microsoft Intune. Firefox supports enterprise policies through a policies file or Windows Group Policy templates and offers an Extended Support Release for slower update rings. Brave accepts many Chromium policies but has fewer management tools of its own. Safari can be configured through Apple device management, with fewer options than the Chromium browsers.

Which browser for whom

Chrome is a strong security choice with fast updates, strict isolation and Safe Browsing, at the cost of weak tracking defaults and close ties to Google's account and advertising business. Edge offers similar engineering with excellent Windows management, and similar trade-offs with Microsoft. Firefox balances privacy defaults, isolation and the most capable content blocking. Safari is the efficient default on Apple devices with good tracking protection, limited by updates tied to the operating system and a smaller extension choice. Brave gives the strongest privacy defaults among the Chromium browsers but adds features beyond browsing that you may want to switch off.

Sources and further reading

1. Chrome for Developers: Manifest V2 support timelinedeveloper.chrome.com
2. Chrome for Developers: two-week release cycledeveloper.chrome.com
3. Mozilla Add-ons blog: Manifest V3 and Manifest V2, March 2024 updateblog.mozilla.org
4. Microsoft Learn: Timeline for migrating to Manifest V3learn.microsoft.com
5. Brave: What Manifest V3 means for Brave Shieldsbrave.com
6. Mozilla: Total Cookie Protection by default for all usersblog.mozilla.org

General information, checked on 31 October 2026. Test changes on one system first and keep a way back. Found something outdated? Tell the editors.