How is it still possible that the attacker can execute code in browser and make the user download an infected file without his knowledge?
In Google Chrome, files are downloaded into the Downloads directory without the user being prompted, so long as the file extension is not on a certain blacklist of known unsafe file types.
For potentially dangerous file types, the user must approve the download and/or opening of the file. There have been attempts to thwart this via click-jacking. Modern browsers such as Chrome and Firefox have a built-in delay to prevent this.
Some users can still be fooled though.
What are the facts when calling a browser secure? all the browsers like mozilla chrome opera call itself secure but none of them are "bulletproof"
The term "bulletproof" is very vague.
In modern browsers, much effort has been applied to fix any vulnerabilities that would allow direct hacking out of the browser's built-in sandbox. It is important you keep your browser up to date to take advantage of these protections. Once you do that, the difference in security of the major browsers gets pretty small.
Even with no 'vulnerabilities' per se, the 'security' of various browsers may not be equal. Also it is highly subjective. There are many complex and edge case features various browser vendors can implement to protect your security.
For example, if a website asks for access to your Microphone and Video, both Firefox and Chrome ask for approval, but Chrome also requires that the website offers HTTPS encryption. Firefox does not have that requirement. (yet) That is not really a security issue in Firefox, nor a bullet-proofing of Chrome, but does make a difference in certain situations, such as public WiFi usage.
Some browsers do not yet support Content Security Policy. However, CSP is only a feature to help developers mitigate their own vulnerabilities.
All of these are very minor differences in the security of a browser.
I have a personal opinion that IE is one of the less secure browsers.
Again, always keep your browser up to date to take advantage of any new security features they have introduced.