Many security experts advise not to click on malicious URLs. How can clicking a URL affect a computer's security?

If a malicious file was downloaded and executed, then a computer's security may be breached, but how can just visiting a URL do this?

2 Answers 2


You can be infected via the use of what is called a drive-by-download exploit. This is how malware can download and install itself on your machine simply by loading a web page that contains it.

It works by finding vulnerabilities that allow it to escape whatever sandboxes it is supposed to be playing in, and execute arbitrary, malicious code on your machine.

Years ago, when early versions of Internet Explorer were the most popular browsers on the web, ActiveX components were the most popular vectors for drive-by-downloads. Presently, other drive-by download vectors appeared such as with Flash Player plugins, Java applets, or PDF and images. In all case, JavaScript is the primary vector that, if used properly by a miscreant, can lead to a drive-by download attacks such as the attack on Firefox that was used to expose personally identifying data for some Tor users.

  • so what happens is, a malicious code segment finds a bug in my browser and enters into my computer through it?
    – DesirePRG
    Aug 23, 2013 at 18:24
  • 3
    @DesirePRG Yes, essentially, but it's more likely to be a bug in a plug-in such as the Adobe Flash player, or the Java JRE, than in the browser itself.
    – Xander
    Aug 23, 2013 at 18:26

It could be part of a Cross Site Reqest Forgery (CSRF) attack which isn't so much an attack on the users computer but an attack on their web application accounts. Say you have an account on CrappyBank.com's website and they are not protecting against CSRF attacks. If CrappyBank uses the following to transfer funds:


A malicious link could look like this:

<a href="http://CrappyBank.com/transfer?dest=HackerAccount&amount=1000">
     Click me!!!

And if you were logged in to your bank account at the time, you would inadvertently be transferring funds to the malicious users account.

  • This doesn't quite answer the question, does it?
    – async
    Oct 25, 2014 at 14:16
  • 1
    I would never open an account at CrappyBank. Something about it just sets off warning bells Oct 25, 2015 at 19:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .