Is it possible for a favicon icon to be malicious so that you get the virus by just looking at the icon in the search results of a search engine like DuckDuckGo that displays the favicon icons for all the results? Or is the image file so small that it is very unlikely that any malicious exploit code could be in there?

  • Favicon is just icon, just like any other image on any other website. Just like duck duck go logo or user photo on Facebook. In theory, browser may have bug and be hacked with image, but I've never heard about it. You should not afraid of Favicon. You do not afraid of images on websites, css on websites, HTML on websites, do you? Same with favicon)) – user996142 Sep 9 '15 at 20:58
  • @user996142: Actually, I use any means I can to prevent unknown images from being cached, I even disabled my cache, and if I see an image, I restart my browser to clear the memory where it will be (although this probably would be too late, but I still do it). Can't you judge by my name? I'm a Paranoid Panda! ;-) And you won't believe the amount of phishing scripts I have got because of cached images... So I know for sure that it can be done, just not sure if it can be with a favicon icon because of the size... – user67447 Sep 9 '15 at 21:02
  • 1
    First hit from Google: symantec.com/security_response/attacksignatures/… – schroeder Sep 9 '15 at 23:37
  • 1
    Second hit: blog.sucuri.net/2014/12/… – schroeder Sep 9 '15 at 23:39
  • 1
    Please indicate what research you did on your own to answer your own question. – schroeder Sep 9 '15 at 23:40

At the moment, no.

Icons are data, not code. There is no mechanism to execute malicious code paths due to the contents of an icon, because icons don't get executed, they just get displayed.

That could change. But it would take a vulnerability to make it so. In that event, the "malicious icon" would be tuned to take advantage of the vulnerability in the software that displayed it.

At the moment, there aren't any of those vulnerabilities that we know of, so the term "malicious favicon" doesn't make sense, as there isn't a way to make one malicious.

That doesn't mean that there never will be, but right now there isn't.


No this cant be done. Neither they are large enough(in size) nor do we have heard as of now. But the world out there is cruel.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy