If you manage to find an updated browser and don’t host any network service it shouldn’t be too dangerous.

Theres no way an hypervisor zero day gets implemented in some random Malware. Those are worth millions and are used in coordinated manual attacks against VIP targets

Such an exploit would not get wasted on some random xp honeypot

Never ever fall for that one. You can look at various regimes in the world what happens when “hate” gets censored. Demonitizing is one thing, technical implementations to “live censor hate” would be catastrophic.