What is the difference between Silverlight and XBAP?

Silverlight is cross-platform and runs its applications in the browser; it can be used anywhere you use a web-browser.

WPF is Windows-only and usually runs its applications on the desktop; it requires that the .NET framework is installed.

Silverlight can be viewed as a subset of WPF (though this isn't technically correct). It does not have quite the feature set that WPF has. What you lose in functionality, though, you gain in adoptability.

WPF can deploy applications through the browser, using what is called an XBAP. This is not the same as Silverlight, though; whereas Silverlight applications are actually integrated into the browser, WPF is merely using the browser as a host for its process.

For a more in-depth guide on the differences between WPF and Silverlight, I would refer to this white-paper on CodePlex.

The big difference is the sandbox. Both are sandboxed, but WPF-Browser apps (e.g. XBAP) can ask for more permissions, but in Silverlight you can't (by design).