That's actually misleading. After reading more about that vulnerability, it is not a vulnerability in the browsers per se, it is a vulnerability in the
IDN standard, or more precisely, in the introduction thereof to a public not accustomed to dealing with the possibility of non-ASCII characters in hostnames. The only reason IE is not vulnerable is because IE still doesn't support IDN/Punycode, even after it's been around for 3-1/2 years.