Generally browsers are designed so it's impossible for merely visiting a website to harm your computer in any way. This is definitely not true of running a desktop app, so in this sense browsing the web is fundamentally more secure than running apps locally.
For an iframe in a game to show a malicious website, the game would probably have to have chosen to do that, which means the game itself is a malicious website. However merely loading or showing it cannot generally harm your computer in any way. If you start interacting with the page it may then try to harm your computer - probably by getting you to download a desktop app, because those are more useful for malicious purposes and it's difficult to do any lasting harm from a website, as browser security is generally very tough and hard to bypass.
A malicious website might try to do something like trick you in to entering your personal details, or pretend to be your bank and try to steal your login details. This isn't anything to do with Construct or HTML5 games though - these are just general risks of browsing the web, and these risks can be mitigated by some general rules of thumb, like don't download desktop apps unless you know for certain they are trustworthy, check the address bar is the website you're expecting, etc. But the bottom line is: websites are pretty much the safest way to run software - they're generally safer than mobile apps, and certainly safer than desktop apps. No other platform has such strict protections for privacy and security.