It&#x27;s a browser engine running trusted code (i.e., code that is currently running with full privileges on your account), so the attack surface is much lower than a browser engine visiting random web pages. Wireshark won&#x27;t suddenly start playing a Flash animation or use WebGL or anything.<p>And it&#x27;s not like GTK+ or Qt are immune from having security vulnerabilities. They&#x27;re rarer than the general class of browser vulnerabilities, but they exist (e.g. Qt had a few image decoder vulnerabilities earlier this year). I&#x27;d guess they&#x27;re about as frequent as the specific subset of browser vulnerabilities when viewing a trusted website.<p>If it&#x27;s a helpful analogy, this is roughly like how Java is a terrible platform for running untrusted <i>applets</i>, but a perfectly fine platform for running <i>software</i> and a very common one for security-sensitive servers. (Except the browsers themselves are way better than the Java plugin.)