I now whitelist javascript and use an adblocker after being hit by a drive-by javascript exploit that installed a bitcoin miner.

After taking these precautions, I haven't had an issue with malware since.