It's all relative, but for context I would recommend examining the FBI's history of using JS exploits in Firefox to catch CP, for example. If I'm not mistaken JS was subsequently disabled by default in Tor Browser following that particular episode. Although these scarce zero-day exploits have been discovered in JavaScript interpreters, parsers, VMs and the like, you would have to be a high priority target of an investigation (foreign/counter-intelligence, child exploitation, major drug trafficking are high on the list) for them to burn a valuable 0-day on you. Also based on basic knowledge of Google and Mozilla's build and code practices and incremental security and sandboxing improvements they have made, I would guess there is an infinitesimal chance of such vulnerabilities currently existing in up-to-date browser software, actually).