...The number of total unique vulnerability disclosures across the industry was down sharply from a year ago. While browservulnerabilities increased slightly, application vulnerabilities dropped and operating system holes were flat, Microsoft said...
http://news.cnet.com/8301-27080_3-10387768-245.html
...Here is their consensus list, in ranked order: Increasingly Sophisticated Web Site Attacks That Exploit BrowserVulnerabilities - Especially On Trusted Web Sites. Web site attacks on browsers are increasingly targeting components...
http://www.sans.org/press/top10menaces08.php