For those willing to put in some effort, the NoScript addon for Firefox gives protection unmatched by anything else that I’ve seen. It not only blocks JavaScript and other active content (Java, Flash, Silverlight, etc) on all sites by default (with easy whitelisting of trusted sites), but it protects you from cross-site scripting, clickjacking, tabnabbing, and some types of cross-site request forgery. Initially lots of sites will break without JavaScript, but you can whitelist the ones you trust with a single click, so pretty soon your usual sites will work just fine. And even if you tell it to allow all sites, it will still give you the protections against XSS, clickjacking, etc.