Yeah, that's definitely some real old news. Was an XSS exploit that was fixed real quick. It required JavaScript to be enabled, so for it to have worked someone would have had to of disabled NoScript in Tail's Firefox. Yet another reason to hate javascript.

No network is immune from exploit, as we've seen with Tor as well. As long as the devs actively fix things once they're made known, then it's all good.