Upgrade to what? If you're vulnerable to a 0-day exploit, you're screwed. If you're vulnerable to a known exploit that the vendor hasn't patched yet, you're screwed. If the page delivers a virus the vendors can't block[1], you're screwed. etc.etc.etc.