The web browser is based on webkit, webkit runs things like flash and java, both of which are possible windows of attack.
The Steam application or Steam game has been mistakenly identified as a virus or “trojan” by certain software as a result of the development of potentially-malicious programs which use the same filenames as valid Steam files (this is a very common practice amongst malicious software writers – many viruses already … Can Steam browser get viruses?