Actually the browser is a non-universal OS which has several vendor extensions and incompatibilities which poke you in the eye day after day.
It's like the UNIX fragmentation in the 90's (OSF/1=Firefox, HPUX=Chrome, Solaris=IE, UNICOS=Opera).
It's possible to build something without holes. You just have to hire the right people and actually think about it before adding shitty features.
All you can really do is test the hell out of something until your chance of encountering a bug during actual use becomes vanishingly small.
You might be able to engineer a browser in this way but it would just be so ludicrously far behind all of the buggy insecure browsers in terms of functionality that it's security benefit would be close to zero because nobody actually used it.
NASA has been able to produce high-quality code, but even their stuff is not 100% bug free. Even if you consider it to be close enough, their cost is incredibly high for the amount of functionality, perhaps 10-100x the usual. So while you're slowly building a nearly-bug-free system NASA-style, you get beaten to market by another guy with a buggier system that gains popularity and becomes entrenched before you even ship.
But on the other hand, as others have pointed out, browsers are now an important enough application platform that they probably should be tested to a similar standard as an OS kernel is.
Personally, having been warned time and time again over the years that IE is one of the least secure browsers available, I just won't use it anymore (except for work-related purposes in a corporate environment where I'm forced to use IE). IE's reputation is terrible for a reason, and I think we're seeing that the buggier, more popular/entrenched system that burns its users over and over again will eventually fall out of favor.
Certainly there's something in between the extremes of Microsoft and NASA in terms of testing and debugging standards.
http://www.schneier.com/blog/archives/2009/10/proving_a_comp...
I'm guessing you're planning on releasing your document viewer/OS sometime around the head death of the universe.
I've worked in the defence industry. The cost of mistakes is very high. In my case I designed communication systems. I have one in the field which was verified mathematically and no defect, vulnerability or bug has been found in 18 years despite counter attacks. This covers the hardware and software portions of the design.
As for my OS or document viewer, 5-8 years is enough time.
The problem is for businesses, most customers pay lot for features and new shiny and give a lot of lip service to the security part.
The problem for open source is, most developers spend their time on features and new shiny, and the security ramifications are an afterthought.
bozo bit: flipped
Oh, this is fun:
Xenix=lynx, BSD=Konqueror, Plan 9=Uzbl
