As far as I know, View page source does not execute any JavaScript, but is that good enough?

  • Could there in theory be any vulnerabilities in the HTML parser or something similar?

  • Have there been any exploits in this area before?

  • How realistic is it getting infected by viewing page source of a malicious website?

The theory kinda says it should be impossible, but I'm looking forward for other opinions.


When viewing the page source, the browser renders the html code without interpretation, that means the scripts that are either embedded or called using the <script/> tag are not executed by the browser.
Any possible risk from displaying the code source would be brought by the browser (could be a bug or vulnerability) not the malicious page itself.

  • 1
    Has there been such a case when that happened? Oct 30 '21 at 20:54
  • 1
    not to my knowledge.
    – elsadek
    Oct 31 '21 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.