I was reading this CompTIA Security+ SYO-201 book, and the author Prowse claims that
Whichever VM you select, the VM cannot cross the software boundaries set in place. For example, a virus might infect a computer when executed and spread to other files in the OS. However, a virus executed in a VM will spread through the VM but not affect the underlying actual OS.
So if I'm running VMWare player and execute some malware on my virtual machine's OS, I don't have to worry about my host system being compromised, at all? What if the virtual machine shares the network with the host machine, and shared folders are enabled? Isn't it still possible for a worm to copy itself to the host machine that way? Isn't the user still vulnerable to AutoRun if the OS is Windows and they insert a USB storage device?
How secure are virtual machines, really? How much do they protect the host machine from malware and attacks?