Malware through HTML 5 player

Question

Just curious if it is possible to get malware through a trusted site hosting an HTML 5 player.

I would imagine since Chrome is in a sandbox, nothing download to your computer?

Answer 1

There are no known public sandbox escapes for the latest version of Chrome so this would require a Chrome 0-day. This means that while it is not impossible it is very unlikely that a particular person has that knowledge.

Also note that such an exploit would possibly be worth quite a lot in the right context and thus unlikely to be widely spread or used on any low-value target.