One of the reasons Firefox is so superior to Internet Explorer is the presence of the must add-on, NoScript. In essence, what NoScript does is turn off java for any site you visit, until you explicitly tell it to allow java from the various contributing parts of the site you are looking at.
It might come as a shock, but most sites host OTHER sites running java, as well as any little java applet they're using for their own purposes. Mostly, these other sites are things like google analytics and double click and other tracking sites. In other case, it might be links through to You Tube and the such. And occasionally, they are links to bad, bad, bad sites. That's how you get drive-by infections. It's not like you are GOING to the bad, bad, bad sites. It's just that those sites are hiding in behind places you think should be perfectly safe.
NoScript stops that. Cold. It's a bit of a nuisance to whitelist sites as you go along, but if you confine your trips to regularly-visited sites that you have already whitelisted, there is no impact whatsoever. And you'll appreciate the protection when travelling elsewhere, the first time you hear of a friend who traveled without the protection. heh, heh, heh.
At any rate, the itch with NoScript is the frequent updates ALWAYS creating the need to show you a web-page with the details ... which mostly, you DON'T CARE ABOUT. It's like a car. As long as it runs, who cares how it runs.
Finally, the good people at GHacks has a solution to the window popping up after an update. You can find the full details here. Basically, type about:config into the url box. Search for noscript.first and then double click on the true value and turn it false. Close the tab, reboot Firefox and Bob's your uncle. That's it in a nutshell, you really SHOULD read the whole article with its various warnings and explanations.