Can you get a virus from viewing Google images?

My browser is Google chrome. When I use Chrome and I look at google images, I can do three things

I can scroll down the page and look at images, or
I can click on an image on the page and a black box appears across my screen with the image itself on the left and on the right the website where the image is coming from is displayed, and also
I am given the options "Visit page" and "View image".

My question is, can you get virus from doing (1) or (2)? I think probably doing (1) is harmless but I'm not sure whether if you do (2) you are actually visiting the site or simply enlarging the image.

Basically I'm worried about malware on Google images.

ThaiCurrySauce

Posted 2015-05-22T18:58:54.327

Reputation: 31

You can indeed by infect by viewing an image that is malware and not an image. I won't say its not possible to be infected by viewing images on Google Images, but I will say, its extremely unlikely since Google scans those images for malware when it archives them in the first place. – Ramhound – 2015-05-22T19:06:20.227

Your question is a little unclear. You talk about “(1)” (look at the “thumbnails”) and “(2)” (click on a “thumbnail”), but then you also refer to “(2a)” (“Visit page”) and “(2b)” (“View image”). I suspect that “(1)” is probably safe, because (AFAIK) at that point, you’re just looking at Google’s cached copies of the images (although if somebody hacks Google, all bets are off). “(2)” is riskier, because now you’re actually retrieving the image from the server where Google found it, and, no matter what checking Google may have done on Thursday, the site might have changed the file since then. – Scott – 2015-05-22T22:21:14.010

“(2a)” is, of course, as safe as visiting any other page that Google finds (i.e., not very). “(2b)” is, surprisingly, almost the same as “(2a)”, as it goes to the page where the image is in a way that allows the site to redirect you to the whole page, thus exposing you to any risk that comes with visiting an untrusted page. To see an example of this, do a Google image search of site:fansshare.com, pick any image, and do “View image”. … … … … … … … Disclaimer: McAfee Site Advisor doesn’t report any problems with fansshare.com, but I certainly do not guarantee that it is safe. – Scott – 2015-05-22T22:22:22.380

Answers

Is it possible? Yes. Is it likely? No.

The image thumbnails shown in the search results (which you call "1") are served directly from the page as embeded data: URLs. No content is served from any non-google server.

google image search thumbnails

The image previews which appear inside a black border inline with the search results and are shown when you click on a thumbnail (which you call "2") embed the image directly from the website which hosts it.

google image search inline preview

There have existed security vulnerabilities in common image formats, which can result in buffer overflows and remote code execution. In practice this is very uncommon, and it's likely that Google would detect this as malware and not show those images in search results. However, if there were a 0-day image format vulnerability and you happened to click an infected image in the search results, just using the inline preview could be enough to result in your computer being compromised.

nhinkle

Posted 2015-05-22T18:58:54.327

Reputation: 35 057

Yes, you certainly can.

As a proof on concept of how to transmit information to the browser through JPEG headers, I can for example create a product image that has a link included in it with my website. Protected browsers will not display that, but unprotected interpreters will (like some other browsers or things like wordpress). I can upload the proof-of-concept files if you need.

Since even that JPEG header can pass info to a page/browser and that has a practical effect (it is being interpreted/processed/displayed), it means a skilled one can pass a lot of risky things.

Overmind

Posted 2015-05-22T18:58:54.327

Reputation: 8 562