It must have lots of leaks, threat vectors, ways to run arbitrary code, because web browsers have lots of complex capabilities and the largest and most advanced software companies in the world keep finding problems in their own systems.