Abstract: Aiming at the prediction of vulnerability, a vulnerability prediction method based on the component dependency graph was proposed. Firstly, the complexity, coupling and cohesion metrics of a software component were defined based on the component dependency graph. Then these metrics were used to establish a machine learning model to predict vulnerabilities in a component. Finally, a crawler tool was designed and implemented to collect all public security vulnerabilities in Mozilla Firefox from version 1.0 to version 43. Based on these data, the prediction model was trained and tested. The results show that the proposed metrics are also effective in vulnerability prediction.