Is it possible to be infected by viruses or other malware while visiting YouTube?

What kind of measures do the YouTube staff take to prevent viruses and malware?


Yes, as you are browsing to a website, the same risks apply:

  • if the website is compromised, then you could download malware onto your machine
  • if you click on a malicious link in the user submitted comments, bad things may happen
  • if you click on a malicious advert (can happen, see Danny's comment below), bad things may happen

None of these are really about YouTube or Google - they are general website risks.

That said, google are generally good at finding and fixing vulnerabilities and flaws. They even pay people who point out bugs. So YouTube may be a lower risk than some other sites. It is a nice target, though, as attackers will see the number of visitors as a potential goldmine.

You can protect yourself by keeping your browser up to date, and using valid codecs (ie don't install custom video codecs that may have come from a dodgy site - they could subvert the video stream into doing something malicious)

  • 2
    +1 for codec comment, that would never have occurred to me. – lynks Feb 1 '13 at 16:48
  • 5
    Note that Google hosts an insane number of ads, and sometimes malicious ads slip by. It's happened several times in the past (see the links in the last paragraph) – BlueRaja - Danny Pflughoeft Feb 1 '13 at 18:55
  • You must not click on a malicious advert to have bad things. There are even Adverts which just infects you when they are loaded. – Serverfrog Feb 16 '17 at 12:07
  • Serverfrog - yup that is my first bullet point :-) – Rory Alsop Feb 16 '17 at 12:55

Well, they call them viral videos, no ? Says it all.

If you worry about the health of your computer instead of your own, then Youtube is, by itself, a rather low risk arena since Google has a huge vested interest in things staying that way. However, don't click on links which are in the videos or in comments, because they can send you anywhere, out of reach of the Google Police. Youtube is full of links and the average human user has trouble refraining from clicking when presented with a video of cute kittens and a promise of more at the other end of a simple mouse click. As usual, the biggest weakness is what lies between the keyboard and the chair.


If Youtube has a persistent XSS vulnerability(or an non-persistent one but that requires some user interaction which is to click the malformed url), then yes, you do have the chance of getting infected as an attacker can simply embed a 1x1 iframe which will link to his java driveby malware. Of course, if you clicked any links that are posted by the users, you may have the chance of visiting a site that contains a java driveby malware.

Prevention that can be done on Youtube's side is of course to patch up the vulnerabilities and maybe to enforce a check on the links that the users post to prevent users from accessing a potentially malicious url.

Prevention that can be done on your side would be to disable Java or update your Java to the latest version(It really depends on you, some needs it but some don't). Another way would be to install a plugin that can block malicious java driveby such as NoScript and of course, update your browser.

  • do you really know the difference between Java and JavaScript ? NoScript does not really block Java, it blocks JavaScript. The Only 3 Things where you come in contact with Java is: through a Applet(which is disabled by default) and, JSP and JSF which are both Serverside Code which produce HTML/JavaScript. – Serverfrog Feb 16 '17 at 12:09

Simple. YouTube has a comments section, description box, and in-video annotations. This means anyone can post URL's on YouTube so clicking the "wrong" URL posted by someone else can potentially lead to malware or a virus.

  • 2
    I'm not sure this adds anything more than the other answers. Did you want to add to what has been already said? – schroeder Apr 29 '16 at 20:06