OS/2 users can get pretty compliant about security as we have a minor platform that was relatively secure. as such many users do not update browsers and other potentially insecure software.
Here is an example of a security vulnerability that allows a malicious actor to download any file on our computers,
https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/. While only targeted at Windows and Linux, there is no reason that it couldn't also target everything in general.
Luckily this particular vulnerability doesn't affect us due to
not being up to date, our old browsers quite possibly have vulnerabilities.
I suggest not running JavaScript by default, perhaps using no-script. Not loading ads as often they come from somewhere else and have exploits attached as the ad companies don't seem to care much. Adblock Plus is one solution. And minimizing usage of Flash by going into the addons manager and setting Flash to always ask for permission to run. Especially important given our old version of Flash. Same could be done for Java.