Again, just to be perfectly clear: assume that any time you browse with <i>any mainstream browser</i> to <i>any malicious website</i>, your browser could probably be popped. Especially if your adversary can bankroll $100,000-$200,000 of security research. That's the number I'd put on this attack.<p>Maybe a reliable IE clientside bumps the number up north of $200,000, because folk wisdom puts the actual value of a reliable IE in the six figures. I don't know. I know what a year of time from someone who can find these bugs costs.