[nandshab]

For example for a long time Firefox didn't have process separation, sandboxing, etc. Basic features. I don't know how it is now

[fredsir]

IIRC, that's all in place, and has been for quite a while.

[symtos]

Another reason is that the official Firefox builds for at least GNU/Linux doesn't employ standard exploit mitigations (stack canaries, position independent code, read-only GOT).