What interests me more, and what the above poster may be asking about is this part: "By concealing its malware within what looks like an ordinary Facebook page, the NSA is able to hack into the targeted computer".
This implies a true drive-by exploit - one not requiring any user interaction. Most of the Windows malware is actually installed by the user - they're tricked into clicking something, thinking it's anti-virus, funny video, "accelerate your internet" or some other innocuous thing. The no-user-action exploits generally have been workable only for plugins, particularly Flash or Java, which the user has allowed to run without any filters.
Like I said in my post and which you echo in your third paragraph, it's one thing to trick users into downloading and running binaries or to exploit a plugin, but it's another thing to imagine malformed packets breaking the security of an entire system.