Google has a built in any-virus protect for the OS. Since you don’t store any files on the device that part of protection is not needed. There are risks that come with the browser and potential to compromise data stored in the cloud. So you still need to be careful on what extensions you download, as well as other web related activity.
Here’s a good suggestion from another thread on the site: “One area of legitimate concern is phishing websites. You can install a browser extension like avast! that has phishing protection if you feel it is necessary. I would also recommend the “HTTPS everywhere” extension and AdBlock. But really, these are just basic security steps for online browsing, and are not specific to Chromebooks.”