It's really interesting to note the relative complexities at work here. Exploits are difficult to find and relatively easy to remove, but pushing security fixes out to everyone at either ends of the connection is a serious problem.. It's very impressive that they changed behaviour and wilfully broke compatibility with a lot of sites to make this change for the better.
There's a lot more to web browsers than just ecmascript and reflowing content, it seems..