Is there a way to measure the level of security provided by a browser?

Question

I am attempting to locate a lightweight browser that adheres to security standards when browsing the web and was wondering if I can measure the level of security provided by each browser so that I can benchmark them.

Answer 1

No, not really. You can measure how long known security vulnerabilities go unpatched, but those usually are fixed pretty quickly, but there's no way to measure how 'secure' a browser is. The real issues are the vulnerabilities that nobody knows about-- and well, nobody knows about those.

Instead, we can measure how long browsers are known to be insecure, which will give better chances of the browser not being exploited. The first part about evaluating this is understanding that there is no such thing as an 'unhackable' browser (or 'unhackable' program, for that matter), only browsers that are harder to hack than others.

The best you really can do in this area is look at what security features the browsers have (assuming those don't have holes in them themselves), and how quickly the dev teams are able to fix vulnerabilities once they arise.

An example of security features would be chrome's sandbox; I'd generally trust that to make it harder to hack that browser than say, IE7 or IE8 with their lack of a sandbox (IE9 has a sandbox I think). You can also add your own layers of security, such as running the browser in a VM (Ex. Windows 7's Virtual XP mode) or another sandbox (such as Sandboxie)

Comparison of browser vulnerabilities can be done using charts that compare the number of unpatched vulnerabilities (Note, link intended to be an example and not guaranteed to be in any way accurate; please look into your own research for more reliable results).

The open source teams for firefox and chrome generally have a better track record for getting vulnerabilities patched quickly and those patches pushed out to users when compared to IE's closed source model. Generally speaking the browsers with larger communities looking over their source code would hopefully have better code-- more eyes looking for vulnerabilities, better chances of them being found, etc.

The key to take away is that the real question you want to ask is "Which browsers minimize the risk of being exploited the most?", which is subtly, but fundamentally different from the original question.