I had an Ubuntu VM running and I was using Firefox in it to look at tutorials; then my antivirus detected an attempt to forcefully install a fake Java Upgrader. From what I know about the VirtualBox NAT option for the network adapter... in fact, all the internet accessing options, is that they use the network capabilities of the host( where else could they get such functionality? ).
So, given the above, I'm inclined to believe that fake Java Upgrader was intended for my virtual machine; but since the VM uses host resources, the fake upgrader was picked up as host traffic( which makes sense, the antivirus watches that at least minimally ). So the question is, how safe are the internet accessing network adapter options for the host? Could that fake upgrader, coded to target the VM( because the VM was the one that tripped on the hostile page ), attack the host instead?