The latter point? Yeah, there's a few things I can point to:
- PNaCl, which was essentially Chrome's ActiveX. Thankfully going away in the near future, after nobody else implemented it. See https://www.cnet.com/news/mozilla-coder-chrome-violates-goog...
- The severe limits applied to the webRequest extension API, breaking extensions such as uBlock Origin, without cross-browser consensus: https://blog.mozilla.org/addons/2019/09/03/mozillas-manifest...
- General implementation of new technologies in the browser, without a proper spec/consensus. See , which has introduced tangible security vulnerabilities into the browser: https://research.securitum.com/security-analysis-of-portal-e...
- Signed HTTP Exchanges and AMP. The controversy around these two has already been well-documented.
- Poorly thought out plans to roll-out default SameSite behaviour whilst a glaring bug was present in Safari which would be exacerbated by the behaviour change (requiring SameSite=None). I'm all for preventing CSRF by default, but these sort of changes should be planned and implemented considerately. See https://news.ycombinator.com/item?id=20905396
- Poor implementation of CT reporting which sent spurious reports to sysadmins even after the policy was supposed to have expired. See https://crbug.com/786563