NIP-07 defines a small JavaScript API that a browser extension exposes on window.nostr. Web clients call window.nostr.signEvent(event) and the extension prompts the user, signs with the stored key, and returns the signed event. The web client never sees the private key.
Extensions that implement this include nos2x, Alby, Flamingo, and several others. The pattern avoids the ugliest failure mode of web-based Nostr clients: asking the user to paste an nsec into a form.