- malicious plugin files (mainly Flash, Silverlight) that exploit vulnerabilities in the plugin (Flash Player, Silverlight Player)
- XSS attacks that attempt to fool the user into giving up credentials to another web site (e.g. banks, PayPal, etc.) that the attacker can use for financial gain.
Anti-virus programs that protect browsing sessions look for and quash known exploits like XSS and malicious plugins. If history is any guide, there are always unreported vulnerabilities, so there are always opportunities for hackers.