Can visiting a malicious website infect an iOS or Android device?
We're talking about visiting such sites via a browser. We're not talking about downloading any malicious apps.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
What day of the week is it?
In theory, no. Merely visiting a site will not infect you.
But as they say, the difference between Theory and Practice is that in Theory there is no difference.
But that's a serious breach in security, and such defects tend to get patched very quickly.
If you visit a website on a day after the malefactors have written code to exploit such a defect but before the day your browser gets patched, then yes, you can get infected. The day before the malicious code is placed on the website, or the day after your browser is patched, you're safe.
Like I said: what day of the week is it?
A simple visit to the most innocent website you know, may trigger an attack that can lead even to a total control of your machine.
Drive-by download attacks that can exploit the vulnerabilities of your browsers and or their plugins and install without your consent or knowledge more or less dangerous malware.
About two years ago there was a website "jailbreakme" that allowed jailbreaking a device just by visiting it; it exploited a vulnerability in Safari's built in PDF viewer and then probably other vulnerabilities to gain root privileges and modify the kernel to allow non-signed code to run.
Although this has been patched, this proves that a mobile device is no different from a desktop computer and malware can exploit vulnerabilities such as that one to execute arbitrary code as the user, and possible using other vulnerabilities for privilege escalation and thus total compromise.