I know that a browser can be compromised somewhat easily. Or at least commonly. For example, one of the worst browsers compromised was the TOR browser with a JavaScript exploit, that, AFAIK, could reveal the users ip address and other info.
However, again, while a browser can be compromised...