NSS Labs says browser protection entails an "'in-the-cloud' reputation-based system that scours the Internet for malicious websites and categorizes content accordingly, either by adding it to a black or white list, or assigning a score (depending on the vendor's approach)." When a browser detects a site as "bad," it will re-direct the user to a warning message or page informing them that the URL is malicious. Sometimes the browser will instruct the user that content is malicious or should be cancelled, the report says.

NSS Labs also says its testing determined that the SafeBrowsing API 2.0, which provides reputation services for executable files (otherwise called "malicious downloads"), has been integrated into Chrome but not Firefox or Safari.

NSS Labs also tested the browsers for protection against click fraud, a crime that abuses pay-per-click advertising through use of malware infection. Click fraud "causes minimal direct harm to the typical end user, as the ultimate target is the ad buyer," the .

According to the testing, the click-fraud catch rates are as follows: IE9 at 96.6%, followed by Chrome at 1.6%, Firefox at 0.8% and Safari at 0.7%. The lab notes the average lifespan of a click fraud URL was 32 hours with over 50% expiring within 54 hours.

NSS Labs recommends that ad buyers "put pressure on Google to increase the click fraud protection capabilities of Chrome and the SafeBrowsing API."