Are you certain that was the attack vector, and if so which specific browser vulnerability was it? I'm not aware of any browser JavaScript sandbox escape vulnerabilities that would allow file write access since about 2015. While it's remotely possible there is a zero-day vulnerability being exploited out there it seems highly unlikely. If your organization has been hit multiple times by similar problems then the IT management must be terribly incompetent.