CVE counting is a poor proxy for actual security. A browser that does not sandbox its renderers or enforce a permissions model on its extensions cannot reasonably be considered secure in 2015.
Why? Surely as with any software one should only install extensions that one trusts?