The more I read about TLS, the more I get convinced that the browser is the weakest link in the chain.
I don't think so, because I think the user itself is the weakest link:
- The user can often be convinced to follow insecure links, even if the browser explicitly warns against it.
- The user can be convinced to install any other software, like dubious plugins, alleged virus scanners which are malware in reality or even different browsers.
- The user trusts the producer of the browser or OS, that every of the 100s of trusted CA in the browser/OS can be fully trusted.
The user is the weakest link because only (s)he ultimately decides whom to trust and which software to install or which sites to visit. Unfortunately these are in reality really complex decisions and the user is unable to do decide themselves, so it defers the decision to the software producers in the hope that they know what the best is and that they don't cheat.
How dangerous is it to use unknown browsers?
It is no more or no less dangerous than to install any other software, where the user does not know what the software really does. The user will trust the software to do the right thing, but the software might do different things instead.
It does not matter much if the user uses a mainstream browser, but also installs some other software which can hook into the browser and sniff everything, modify contents and steal credentials.