The few times I've caught on-load viruses was when visiting big sites. Turns out their ad networks often get compromised and suddenly reddit or facebook are loading exploits.

Virtualizing and sandboxing the browser in a secure way is the only way out of this. On top of an eventual move to memory safe languages.