Malvertising, or malicious advertising, displayed by the sites were found to be installing harmful files without Internet users' knowledge at a high rate.
The data, according to researcher Conrad Longmore, showed that xHamster had malvertising on 1,067 out of 20,986 pages, or 5 percent, screened in the past 90 days. PornHub was found to have malvertising on 12.7 percent of its pages.
Longmore noted that, according to Alexa's statistics, the average user of xHamster would look at 10.3 individual pages — meaning a potential 42 percent risk of stumbling across harmful advertising in each viewing session. Worldwide, Alexa ranks xHamster as No. 26, while PornHub is ranked No. 63
While the two sites observed didn't host any malware themselves, Longmore said it was the embedded advertisements within their pages that created problems for users.
"The way the ads are bought and sold across all websites is incredibly complex," Longmore told the BBC. "Ads can often be repackaged and resold so that it is hard to tell where they originated from, and the criminals behind them go to great lengths to disguise what they are doing.
"Site operators could put a quick reporting mechanism on their sites to flag up bad ads and other concerns, and ad networks should also take some responsibility here," he said. "I don't see that happening any time soon, and perhaps the best thing that users of these sites can do is ensure that their machines are up to date."