I don't think you understand how attack surface works. I am not pointing to a list of CVEs and scaremongering–in fact I didn't even list any. I honestly have no

I don't think you understand how attack surface works. I am not pointing to a list of CVEs and scaremongering–in fact I didn't even list any. I honestly have no idea how many there are beyond there being a lot. The actual problem here, which you have missed, is that when you run your browser on Windows XP (let's assume, for the same of argument, that it's a fully up-to-date browser somehow, instead of like Firefox from 10 years ago), it will assume that the system it is running on is not completely broken. And that is not true for Windows XP. This means that when it goes to talk to your graphics card it will expect that it can pass command buffers to the OS and they will faithfully be forwarded without the system dying, except XP is old enough that it probably is missing half a dozen checks on that code path, and when you fail one of those checks someone with who took a 4 week binary exploitation class can probably pwn your entire machine. So yeah, that's what I am talking about.