[dmaz]

The scores are predetermined, according to http://yourbrowsermatters.org/docs/methodology.pdf

Most of the security features that were included in the score are publically documented by the browser manufacturers and the presence can be verified directly through the browser itself. Additionally, tools like the Sys Internals process expirer were used to verify the use of DEP, Protected Mode, and ASLR.