Chrome had a nasty one back in March, so your presumption seems correct.

Really, the best way to protect yourself is to use an obscure OS, or a separate machine for web browsing. Sounds paranoid, but the web is THE main attack vector these days.

There are disadvantages to using an obscure OS too, in that it is likely slower to get security fixes, and may have more security flaws.

The only logical answer is to write your own OS

The ultimate security by obscurity

You could use something like NixOS, which has interpreters, libc, etc. in non-canonical paths. And you still have the protections of Linux and speedy security updates.

Of course, this is security by obscurity, an attacker could adjust the malware for such cases.

Or disable JavaScript, which is the cause of most RCE exploits.

Do you mean whitelist JavasScript to known good sites?

HN is about the only site that I frequent that is usable without JS.

The progressive enhancement ship has sailed into abyss.

You could use Qubes OS[0] which will allow you to isolate different aspects of your computing into separate VMs easily.

[0] https://www.qubes-os.org/

Previous discussion about the zero-day itself: https://news.ycombinator.com/item?id=20233952

Browsers have zero-days sometimes; this is a valid question worth asking, but for now I wouldn't tell anyone to ditch Firefox over this, any more than I would tell someone to ditch MacOS over this.

How common are browser 0-days? It seems like everyone makes mistakes. Eg Chrome patched CVE-2019-5786 last month.