If I keep all incoming connections blocked, but also all outgoing connections blocked except my browser (no MS/Win service is communicating with anything online), would my attack surface be just the browser? So it wouldn’t matter if Win is not updated?
the browser has historically been one of the most suceptsble vectors of hacking.
theres a reason why most older consoles often have an exploit related to getting access to protected regions of memory via corruption using the browser, and why modern Nintendo and PlayStation consoles do not have a built in browser for consumer use.
the browser is the biggest offender for viruses.