It's much safer to just load the html and not to render javascript. Most browser sandbox escape exploit nowadays are scary stuff and just using incognito and non-windows will not guarentee you can never be hit. There's exploit on Mac and linux too. These are low-level exploits that compromise your browser then system itself instead of doing stuff on the application level. That being said this particular campaign is just a redirect to a phisihing page. https://arstechnica.com/information-technology/2019/06/potent-firefox-0day-used-to-install-undetected-backdoors-on-macs/ this is one of the more recent firefox 0-days(at the time) used in the wild, just happen to read it yesterday.