Question

I would like to know how browser allow viruses to pass through to our computers. Response we receive is a text response.. Only executable thing in the response is JavaScript which does not have much privileges, what makes browser favor certain files to be passed to computer?

Answer 1

The short list:

1. Browser plugins. ActiveX* in general and Flash in particular are notorious for having holes.
2. Buffer overflows. Forming either HTML pages or Javascript in a specific way can lead to being able to write anything you want into memory… which can then lead to remote execution.
3. Other errors. I recall bugs in the past where the browser could be tricked into downloading files into a known location, then execute them.

*Google is working on expanding this particular kind of hole to other browsers with Native Client.