What can one actually gain access to with such an attack? And what if you have a firewall that only allows specific programs/services through? It would have to

What can one actually gain access to with such an attack? And what if you have a firewall that only allows specific programs/services through? It would have to use the browser, but how, through an add-on that the user would have to install? Seems pretty complicated for a random machine, more likely to target government/company computers... I don't see why everyone is forced to install the updates.