Lets say, I visited a "malicioussite.com" and the server had a "malicious.js" in it whose job is to write malicious code to my browser localStorage and save it to the my computer then execute it to infect my computer.

I don't think this is possible but after researching a little bit I found this page which explains how to write localStorage data to a file and save it .Then I found this page which explains how to execute bat files with javascript. I know that no browser would allow such a security breach but I still wonder if this can happen.

1 Answer 1


It is not standardized how a web browser saves the data it gets asked to store in localstorage. But it is very unlikely that it will be implemented in a way that it ends up as a valid executable file, and even when it would be, it is unlikely to be a file you or your operating system would ever execute. Security vulnerabilities in the implementation details of specific browsers are of course always possible, but the standard has no obvious ones.

The two stackoverflow questions you found are misleading.

The first one requires user interaction to intentionally save a file, and that file could come from anywhere, not just the users webstorage. Popping up a download dialog for an arbitrary file using javascript is web developer 101 knowledge (it's document.location = "http://example.com/malicious_file.exe" when you want to know) and any internet user should know better than to save and execute random executable files they get prompted to download.

The second works only on IE and only when the HTML page is loaded from the local filesystem, not from a remote webserver.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .