Windows XP support ends April 8th, 2014 and with no further security updates this is not the OS to be surfing the Internet with after that date! That said, it doesn't matter what OS the Host or Guest is if there is connectivity between them or other systems they might connect to. All appropriate security measures need to be taken on each system, physical or virtual, to guard against any threat as the only 100% assured way of not getting hit would be to turn the system off and never again turn it on! Security is analogous to a block of swiss cheese in that there will always be some holes and the best defense aside from having appropriate software installed is not surfing indiscriminately. How many teenage kids really care what sites they go to?
Thanks, but I was asking in a more general sense rather than an absolute. As the NSA is showing no software is 100% secure.
I am talking about an acceptable level of risk.
Also, you might note that support for win2000 ended many years back bit there are still some 12% of PCs running it. Maybe not surfing the web, but msoft will still push out serious security updates as they did just recently over that IE zero-day or whatever it was.