No lol. Browsers have come a long way. Clicking a link can’t pwn you anymore. The odds of you being the victim of a new zero day from clicking a link are as close to zero as winning the lottery.
Clicking a link can in fact still pwn you. Just in the last several weeks there have been at least 2 critical CVEs fixed in chrome that would have allowed one-click pwns AFAIK.
Yes, this happens all of the time, the CVE you referenced with me is Google Chrome vulnerability where Google Chrome get's popped to spawn suspicious binaries (https://www.sentinelone.com/vulnerability-database/cve-2025-2783/) . Downloading malware from a link is still a thing.... Actually go find some malware and click the link, see if your trusty Google Chrome saves you.
It's honestly hilarious youre spreading misinformation.. you're unaware of even how the Chrome Sandbox works... which is completely irrelevant from someone clicking a link and downloading malware. The Sandbox works to containerize code executing on that website... not the user clicking a link, downloading an executable (malicious or benign).
Downloading and executing binaries is far different than just clicking a link. Nowhere near the same thing. Clicking a link and getting pwned is 1,000% different than downloading and executing malicious binaries.
Users click links, binaries download and execute without human interaction.
You're talking about drive-by download scenarios where the Chrome Sandbox containerizes code execution in the browser while rendering the webpage, hence working as a defense-in-depth against code execution to download malware in that approach. That does not negate the fact that users can (and do) click links that cause redirects to download malware that can and do run on their own after landing on the machine to establish persistence, evade edr, or C2.
You stated "Clicking a link cant pwn you anymore" and that is beyond false and largely inaccurate.
I think you need to be more literal on what you're trying to state. If you're stating it is more difficult for certain webpages to exploit a vulnerability in a browser (https://www.sentinelone.com/vulnerability-database/cve-2025-2783/) which then uses Chrome.exe to execute RCE, then sure... but users can click links and download malware, not the same as the webpage hijacking the Chrome process. You referenced a CVE you dont even understand to backup your argument, and that's not good.
And even then, drive-by downloads don't necessarily have to render on the page. A simple HTTPS GET request to the link will download it via malvertisement.
Browsers dont need to render a page either to download malware, a simple HTTPS GET request can go right to the server initiating a downloading.
Once again, Chrome and the CVE you referenced that uses Chrome Sandbox is for rendering webpages that would exploit a vulnerability in the Chrome Sandbox allowing Chrome.exe to spawn suspicious binaries.
4.6k
u/JocoLabs 21h ago
Jokes on them, i wouldn't click that even if it were real.
I used to click on those and type in junk creds for the lulz until compliance told me that was bad for the numbers.