Are browser UIs themselves vectors for serious exploits?

Orion uses WebKit and I assume they try to track as close to the release branch as possible. So if you trust WebKit, you can trust Orion.

Personally I'm more of a Brave guy though, despite having been a Kagi user since 2024 :).

What I'd really wish for is an EU browser that 'just works'. Vivaldi is nice but it often has papercuts because it has a small team behind it that have to try to support a mountain of features.

> Orion uses WebKit and _I assume_ they try to track as close to the release branch as possible. So if you trust WebKit, you can trust Orion.

The problem is you're stuck at assuming, but can't verify.

> What I'd really wish for is an EU browser that 'just works'.

Have you tried Zen Browser? It's entirely open source but the core team and sponsor are European, and it's actively positioning itself as the European alternative. I've been giving it a go lately. So far, so good, and I like most of their UI/UX choices.

There’s a lot of ways you can hold an engine wrong. Some 3rd party browser (often by security vendors…) have been vulnerable to exploits due to not compiling it with all the hardening options, or injecting vulnerable extensions that expose an attack surface to the webpage, for instance.

When a vendor bundles their own code with Webkit, it's quite easy for that vendor's code to have it's own security vulnerabilities, yes commonly in the UI, but also to open security vulnerabilities in Webkit. There's also no telling how much they've modified Webkit itself to make the rest of their code work. You simply cannot trust it and there are many security failure modes here. If you cannot inspect it all, you are trusting the vendor and I would be very careful trusting un-tested vendors of the most complex programs ever written which hold your credit cards and all of your logins probably your bank as well. I damn well would not trust the first few versions before the white hats have had a few years poking at it.