tmpaccount823
Re:Exploit vendor drops Tor Browser zero-day on Twitter
on Tuesday September 11, 2018 @03:20PM (#17962468)
I can confirm that setting javascript.enabled to false would have prevented that bug in older versions.
I've always thought that the highest security setting would set it to false on its own, but apparently it does not.