&gt; That the one where someone owned your machine or at least read everything in ~&#x2F;.ssh and ~&#x2F;Application Support.<p>Not if they didn&#x27;t combine it with a sandbox escape, and Safari is sandboxed too. (The profile is less restrictive than that of Chrome, but both would disallow reading your SSH keys.)<p>Also, counting vulnerabilities like this is pointless, given that the two browsers share a very similar rendering engine and there&#x27;s a not-insignificant chance that vulnerabilities in one engine apply to the other.