Looking at the Pwn2Own contest got me thinking:


If you have all plugins turned off on a browser, and all you have is HTML, CSS, and JavaScript running in the browser, can you still become infected with malware? I suppose I never gave it much thought, but just how is it that these viruses can "install themselves"? If you uninstall these plugins and have your browser prompt you for all downloads, you should be "safe" right?

4 Answers 4


Even with just Html,CSS, and javascript an attacker or malicious site could still attempt to exploit bugs in the browser that would allow them to exploit a machine. Or create dialogs and attempt to trick a user into allowing permission to install malware. This was one example I found by googling javascript and malware install. If anything plugins create a wider attack surface, but without them that doesn't eliminate the attack surface relative to the browser that you use. For example if there is a browser vulnerability that allows remote code execution a malicious website could potentially use javascript to exploit the vulnerability. Hope that helps some.


An answer has been accepted here, however I don't think the answers provided address the question very well.

Classically the asset targeted by malware was the same machine where the malware is eployed - but in a networked world, that's just not the case any more. If javascript or even just html in some cases is loaded and processed by a browser it can have undesirable effects without having to be installed or even stored on the victim's machine - it may be targeting a service on a different machine, e.g.

  • a DDOS targetting an HTTP server
  • a CSRF, perhaps exploiting 'remember me' functionality to create fraudulent transactons
  • running a host/port scan inside a protected network (yes, this can be done quite easily with javascript and without the use of websockets)

Note that first and second don't even require javascript.

If the browser (or plugin) processing the potential malware does have security vulnerabilities, then malware can exploit these to damage the client system and or deploy itself/further malware directly on the clients long term storage.


Essentially all BROWSER vulnerabilities (ie. not vulns. in plugins like java or flash) involve and rely on JavaScript (JS) running. This is because JS is incredibly powerful. When visiting a web page with JS you're running someone's program in your computer. It is your browser that interprets JS and decides what to do. Since it's such a large, powerful, and complex language, it leaves a lot of room for bugs in the implementation which potentially turn into vulnerabilities.


  • 3
    This isn't necessarily true. While there are certainly vulnerabilities that rely on JavaScript, there are many that don't. For example you can disable JavaScript and still be vulnerable to malicious ActiveX objects, or Java applets, or SWFs, or PDFs, or any object that requires a plugin to load that can be manipulated for evil purposes.
    – Xander
    Commented Mar 8, 2013 at 23:19
  • 1
    I did say essentially all, not all - and: With the exception of ActiveX, I'd classify those as plugin vulnerabilities, not browser vulns. The question was about browser problems with plugins disabled. Maybe I should have been more clear. Thanks for the downvote!
    – GBC
    Commented Mar 9, 2013 at 0:21
  • I understood what you meant: If you turn off everything else, and just go with plain vanilla HTML, CSS, and JavaScript, you're still vulnerable.
    – John
    Commented Mar 11, 2013 at 18:26

Firstly, a malicious website can fill up your hard disk using localStorage (see FillDisk, be sure to click the "stop this madness" button before leaving the site. Or don't click that link and just see the explanation here). I don't think there have been any cases of malware being saved on a computer via localStorage, since the data is stuffed into a small database.

Besides this, on Chromium/Firefox, a website can make you download and install an extension/userscript. You are asked for confirmation first, but once the extension is installed, it potentially has access to all your data on all sites (including passwords).

On Chrome, it is harder to force you to install an extension since you can only install via the Chrome Web Store, though someone may be able to bypass this via clever clickjacking.

Another thing JS can do is launch an application (like iTunes or Ubuntu Software Center) via a custom URL scheme, and if you have a downloader application (or something that can be used as one), this may be exploitable. This asks for confirmation though.

Aside from that, JS can't get EXEs/etc onto you computer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .