According to Symantec's twice-yearly Internet Security Threat Report, hackers found 47 bugs in Mozilla's open-source browsers and 38 bugs in Internet Explorer (IE) during the first six months of this year.
That's up significantly from the 17 Mozilla and 25 IE bugs found in the previous six months.
Even Apple's Safari browser saw its bugs double, jumping from six in the last half of 2005 to 12 in the first half of 2006. Opera was the only browser tracked by Symantec that saw the number of vulnerabilities decline, but not by much. Opera bugs dropped from nine to seven during the period.
And while Internet Explorer remained the most popular choice of attackers, no one is invulnerable. According to the report, 31 percent of attacks during the period targeted more than one browser, and 20 percent took aim at Mozilla's Firefox.
"There is no safe browser," said Vincent Weafer, senior director with Symantec Security Response. "If you've got a browser, make sure you're configuring it correctly," he added. "That's a far better strategy than running some browser just because you haven't heard of it."
Part of the rise is due to the growing market for vulnerabilities, Weafer said. Legitimate companies such as 3Com's Tipping Point and Verisign' s iDefense pay for this information, and there is also a growing black market for exploits. "People are encouraged and getting money for finding vulnerabilities, so now you have more people looking," said Weafer.
Browser bugs are also relatively easy to find and exploit, said Marc Maiffret, chief technology officer with eEye Digital Security. "Everyone has realized that targeting the applications on the desktop is a better way to break into businesses and consumers and steal things than server flaws," he said via instant message.