You can lookup vulnerabilities at http://cve.mitre.org/. "CVE is a dictionary of publicly known information security vulnerabilities and exposures."
A rough seearchsearch of:
- Firefox, returns 888
- Chrome, returns 729
- Flash, returns 371
Further filtering of the severity of these would need to be done, but this gives an upper bound of found vulnerabilities.
http://web.nvd.nist.gov/view/vuln/search allows for the filtering based off of time period, with only cveCVE checkbox selected, a searchsearches of 3 years, and 3 months gives the following respectively:
- Firefox, returns 391, 64
- Chrome, returns 653, 80
- Flash, returns 227, 16