The short answer: they know a very limited number.
HTTP Strict Transport Security was introduced to provide better guarantees that a website is being served over HTTPS when specified by the operator.
This works well for websites you have visited recently as your browser will remember their HSTS policy and refuse a plaintext connection.
For example, if you visit your (previous visited from home) bank's website from an untrusted network that happens to have a man in the middle attempting to downgrade the connection to plain HTTP, your browser will refuse to connect because it remembers the website's security policy.
If you have not visited the site previously, the man in the middle needs to not only downgrade the connection security, but also remove the HSTS header (
Strict-Transport-Security) from the response. This isn't difficult.
The problem you have identified is the major limitation: what happens if you are the victim of a downgrade attack during the first visit.
One solution browsers have implemented is to package a "pre-loaded HSTS list" of popular websites known to require HTTPS. Obviously this cannot be comprehensive and even with the list, attackers can still setup security downgrade proxies at slightly related DNS names.
You can submit a domain for inclusion in the HSTS Preload List at hstspreload.org.