Presumably running a plugin like noscript or disabling JS would mitigate this attack, then.

I wonder if at some point we're going to have a backlash against JS apps, which are really just the fat clients of the 1990s in a new container, as attackers discover more and more exploitable weaknesses in client JavaScript implementations.