Comparing the number of CVEs is not a good way to compare how vulnerable different browsers are. For instance, I believe that Firefox and maybe Chrome bucket together multiple internally reported vulnerabilities into a single CVE.