the boss checked my computer history and saw AF

[Aractus]

...unless it states it in the company policy of course.

And as I mentioned, clearly, in my post, there are clear limitations to what company polices can specify. They could specify that you cannot use work computers for person reasons at any time - however they would need (at least in most jurisdictions) to have a valid reason to justify the policy.

How about this one: Employees might visit malware infested websites that install spyware or other viruses on our work computers, which then can infect our network.

Speaking as a security professional, that's a big reason why companies today would make it part of the company policy (and likely also the security policy) not to use the Internet for personal browsing.

That's not going to make a significant difference to the risk of Malware. Heck when you're googling your way through researching your clients and whatever else you need to do, you'll be far more likely to hit a website that you've never visited that has been compromised, compared to relatively safe sites that you frequent like this one. Many small business websites are far easier to hack than well set-up forums. And in fact I've seen them hacked many times before.

There's nothing really stopping me from installing code in this website that would call back to my computer, at which point I could attempt any number of known browser exploits and potentially gain access to someone's machine.

There's plenty stopping you from doing that. Number 1. the company does not install flash, and sets up a group policy blocking flash from being installed. Number 2. the company does not install adobe reader, and instead uses an alternative. Number 3. Keeps windows security up to date. Number 4. has anti-virus installed. Number 5. Improves the security of FireFox and Chrome by adding certain extensions - especially uBlockO.

As I mentioned though, forums are a less likely spot to find malware (except through advertising), the sites that get hacked the most are the small businesses sites that are poorly secured. And those are the ones that you're going to be visiting as a part of your job, therefore the greatest security risk is from company activity, not from visiting a few personal websites.