Keeping web browsers on the most up to date version and also the plugins that are used is pretty much all we do.
Is there anything I else I can do to reduce the risk of browser exploits? The only thing I can think of that would help is least priviledge user accounts but that's quite a general good practice.
Given that a lot of browser base malware is delivered via ad networks, a decent way to reduce risks would be to use an ad blocker (e.g. Ad Block Plus).
Also something like Ghostery can disable a lot of, likely superfluous, 3rd party content on sites you're browsing, which again could host malware. Realistically any content you don't visit is content that can't give return malicious content.
Additionally things like reputation filters can be useful, either those built into the browser, or one's from 3rd party security software providers.
You can try switching to Whitehat Security's Aviator browser if you're a home user. If you're working in a business, you may try and present it to management as an option. Another alternative is to run a local squid proxy to intercept between a site and a browser. Doing so would enable you to use something like White Trash that works to minimize the amount of garbage sites making their way from the Internet, to your browser.
The biggest hurdle you will face, is one of what is akin to an "arms race" where attackers are constantly trying to weaponize an exploit to disaffect someone browsing. There is little you can do against some exploits/attacks given that most attacks aren't even patched until they are problematic (someone detects something odd). The work around would be vigilance in watching where your connections are coming from, and going to. You could try blacklisting known bad addresses, but this too becomes cumbersome when blacklists can easily run into the thousands.
There are also some low level options like modifying your user-agent as certain types of malware have the capabilities of detecting what browser you're using, in order to use the right exploit against you. E.g.: "if user == IE ; then send IE_exploit ; fi" So theoretically, if you're using say Firefox, with the user-agent of IE, a targeted exploit would fail.
When all is said and done, I always state that these attacks (browser based) are a law of averages. As an attacker, I would create exploits targeting browsers in this order: IE, Firefox, Chrome, Safari, Opera." The reason is simple, this is what I perceive to be in the highest pecking order. (I would get more bang for my buck). With that as a theory, the likelihood of someone targeting say Aviator is low. And if all else fails, you could use a text based browser such as lynx/links which do not run any kind of application/scripts (Flash, Java, etc.)
The #1 best way to prevent browser exploits and still browse the web is using a text-browser (links or lynx are good examples) since these do not show images, use css or javascript they are more or less safe from all the nasties of the modern internet. the downside is, no images and no javascript. but if all you wanna do is look something up. its a feasible way to go.
Do not install browser plugins you do not need. Lot of attacks exploit the vulnerabilities of these plugins. Some of these plugins are also a threat by themselves, for instance CoolWebSearch is a common browser hijacker. Also you need to review your browser’s privacy and security settings.
An other alternative may be to surf using a virtual machine so that you can keep your host machine protected.
Also you can set a proxy to filter your connexions.
My #1 rule is to not browse the internet using a browser that has the same permissions as root/administrator. Instead, launch it with the lowest possible permissions such as a standard user.
US-CERT has a great post. While it may be dated, the topics still apply today and provides a number of links for additional information.
