I think the browser itself gets updates, but I have not updated the OS. I also only visit a handful of websites that I trust. If I want to "wander off" then I am using Tails on a dedicated computer.