If you're a security newb like me but you are using Qubes, update your dom0 software and this vulnerability is fixed. run:

sudo qubes-dom0-update

The exploit itself allows an attacker who gains control of one domain (like your untrusted cat video domain) to execute scripts in any domain.