Firstly for Internet Explorer (IE9 onwards) you need to ensure that you have enabled XBAP/XAML support:
For Firefox and Chrome you have to do something a bit different:
But in addition to the above you need to be aware that when you run an XBAP application it runs in the Internet Zone....so your biggest problem is that normally you don't have full-trust...therefore your application can't call privileged code...if it tries to then you get security exceptions.
One way to get your XBAP to be "trusted" is to get it signed with a certificate (you should purchase a proper one from Verisign rather than use a test certificate) and deployed with ClickOnce.
Or you can keep your application as a regular WPF .EXE and use ClickOnce to deploy it from a website but run it locally with full trust.