@pixx @j3rn having done work on both, web browser is way, way scarier. Mostly because it consists of many overlapping, wildly different bits, each extremely complex on its own and with a plethora of platform dependencies on top. And all the inputs are considered potentially malicious by default.

Also there's usually at least one compiler within a browser, possibly more.