The reality is that you must read the release notes for this to be a strategy that can even remotely minimize your risk. On one side, relatively minor upgrades

The reality is that you must read the release notes for this to be a strategy that can even remotely minimize your risk. On one side, relatively minor upgrades can have huge impacts for some use cases. Some changes are riskier than others, but SemVer and major/minor distinctions are not reliable signals for anything critical. More important though, if you're skipping browser updates at all, you need to be tracking the security implications of every patch you skip. Otherwise you're increasing your risk by an order of magnitude more than you'd reduce it by deciding a change might be too buggy based on a numbering scheme.