If you are running Java in your browser, you were exposed. There, done. The internet is a nasty place, get used it.
Even browser updating automatically aren't a panacea: the update itself may be corrupted by an exploit (now that would be a fiasco).
That is precisely the reason people should surf from a separate user account, using very strict firewalling rules.
"iptables -I OUTPUT -p tcp --dport 80 (and 443) -m state --state NEW -m user --user-id 501 -j ACCEPT"
Now it's too bad per-user firewalling cannot be done easily on neither Windows nor OS X.
It's also too bad one user (say the one allowed to surf the Web) cannot display its browser window(s) in another user (say your main account)'s graphical display (neither on Windows nor on OS X).
Or too bad OS X doesn't allow to run two graphical sessions simultaneously (on some version of Windows, if you pay enough, at least you can do that).
All this is trivial to do under Linux.
I'm feeling better and better using Linux as my desktop.
(Amazing, because look what you've done! Terrible, because almost every other human on this planet could not accomplish your outcome even with guides and training...)
Now it's too bad per-user firewalling cannot be
done easily on neither Windows nor OS X.
It's also too bad one user (say the one allowed
to surf the Web) cannot display its browser window(s)
in another user (say your main account)'s graphical
display (neither on Windows nor on OS X).
$ /Applications/Safari.app/Contents/MacOS/Safari
Seems to work for me.
Or too bad OS X doesn't allow to run two graphical
sessions simultaneously
uid user
Match all TCP or UDP packets sent by or received for a
user. A user may be matched by name or identification
number.
In the same way a stubborn mathematical proof is trivial, I'm sure.