Disclaimer : I am not very knowledgeable about the behaviour of anti-viruses (anti-viri?).

I was wondering how they discern between malicious and non-malicious pages if all they can read is the HTML and JavaScript.

Do they just have a list of sites that are deemed malicious that are updated? If it has .exe downloadable files? How?

  • Need any more information added to my answer? Commented May 30, 2015 at 18:32

3 Answers 3


HTML and JavaScript, when employed in specific ways, can be used to o wn your system, even your home router. The attack vectors against a web browser involve things like:

  1. malicious plugin files (mainly Flash, Silverlight) that exploit vulnerabilities in the plugin (Flash Player, Silverlight Player)
  2. JavaScript that exploits vulnerabilities in the browser's JavaScript engine
  3. XSS attacks that attempt to fool the user into giving up credentials to another web site (e.g. banks, PayPal, etc.) that the attacker can use for financial gain.

Anti-virus programs that protect browsing sessions look for and quash known exploits like XSS and malicious plugins. If history is any guide, there are always unreported vulnerabilities, so there are always opportunities for hackers.


Just like anti-virus identifies malware on your local machine - by checking for virus signatures.

Although executable code cannot normally be ran through your web browser automatically, if there is a flaw in the browser or in a plugin such as Flash or Java, then the web page can exploit this to trigger a "drive by download".

On example is this heap overflow in Internet Explorer when it tries to parse <col> HTML elements in the page. AV tools could be looking to see if the page implements this exploit by looking at the construction of <col> elements, or for looking for shellcode signatures within any page content (more likely the latter as this would be more universal and not tied into a specific exploit).


Today, nearly all Antivirus softwares comes with a browser extension. When you install the Antivirus, it automatically installs its extensions to browsers. This extension observe user actions and search for malicious codes. Modern antivirus softwares tries to protect user from known attacks by using this technique efficently.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .