Looks like having Javascript enabled makes these vulnerabilities a lot easier to exploit the masses with. But, still they seem tricky to pull off. Interesting how the older architctures seem to have fewer security bugs.