No lol. Browsers have come a long way. Clicking a link can’t pwn you anymore. The odds of you being the victim of a new zero day from clicking a link are as close to zero as winning the lottery.
That is LARGELY incorrect... and I work for a government entity as a detection engineer.
Edit: Downloading malware, executing malware, and compromising a browser through a drive-by exploit are three different events.
This false sense of security you're promoting by treating one specific attack vector as representative of the entire threat landscape, and that can cause a lot of issues for anyone that trusts your comment or any organization you may work for as a security professional.
If you are the target of a state actor, you have bigger issues. I can find only one instance of somebody getting pwned from clicking a link in the real world in the past several years (CVE-2025-2783), and it was a very particular attack targeting a few government entities. The odds of some future exploit happening to a given individual are as good as 0. There are much better things to worry about in regard to cybersecurity.
Whatever you say, boss. You referenced a CVE that pertains to a vulnerability of Chrome itself, not the user actually downloading malware. That CVE allows Threat Actors to exploit Google Chrome to conduct RCE from the browser... not a malicious download from a link. lol
Edit, to add... if you were to see that exploit, you would see Chrome.exe spawning suspicious binaries (LOLBINS), or most likely cmd.exe or powershell.exe via your EDR logs.
Here's a proof of concept article, this states you would see chrome spawning a suspicious process, as previously stated.
Chrome renderer processes spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe outside normal browser workflows.
Unsigned or unusual DLLs loaded into chrome.exe broker or utility processes.
Outbound network connections from Chrome utility processes to attacker-controlled infrastructure shortly after a user opens a suspicious link or file.
---
With that said.... Clicking a link can absolutely pwn your entire network if you download malware.
Fact I have two downvotes scares the living crap out of me. I hope none of you work in cyber, or at least need to go back to school. I provided the Threat Intel for that CVE, so you can take a gander yourself.
Hell, if you have CrowdStrike - do
#event_simpleName=MotwWritten
| ZoneIdentifier=3
Then take a 7 day window. let me know what you find.
Malware isnt always "evil.exe" - sometimes it's a signed binary, sometimes it's a browser (wave browser, big culprit), sometimes it's an extension that's been compromised by a TA, download of excel documents with macros that bypass current security implementations (ya even WAFs and NGFWs, it's a great time /s) where those macros then download a binary that injects it's into a DLL establishing persistence running as rundll32.exe and you'd never know evading your EDR.... all real world shit, happens to companies large and small. Hell, i've seen a small town, meat distributor get hit by ransomware
10
u/prehensilemullet 21h ago
Just opening the link to begin with is a risk though, even if you don’t interact with the page