I am aware that on Windows this is very much possible. But is it possible on Android (latest OS with all the security updates)? Can you install a virus/malware/spyware by just clicking on an image? Suppose the image is sent via WhatsApp/any other messenger?

  • 2
    This question is not about computer hardware or software, within the scope defined in the help center.
    – Ramhound
    Commented Oct 9, 2018 at 18:06
  • 1
    You'll probably get a better answer from Information Security than from Super User. It is an attack vector that that hackers use, but it is very hard to say if it is possible in your case. Probably it is. One has to find an exploit for that though. Security is not a binary state.
    – Aulis Ronkainen
    Commented Oct 9, 2018 at 18:16

3 Answers 3


Your comment about Windows is probably referring to WMF images, which aren't exactly 'normal' image files. They can contain actual natively executable code, including being able to make some very low-level calls directly into the graphics drivers. Most other image formats only contain actual image data (and usually some metadata about things like what color correction to do, what time the image was created, etc).

In theory, it's still possible to exploit normal image files though. There have been a number of vulnerabilities over the years in various image handling libraries that could be used as starting points for actual ACE exploits (though the full exploit is likely to be platform specific). These all just required an image to be processed by the library (so, displayed in an application that uses the vulnerable library).

However, it's a pretty unlikely attack vector for any realistic malware. Coding an image that can exploit these issues and doesn't immediately arouse suspicion (either due to the size of the file, ro the lack of any content) is pretty hard, and given that these bugs tend to get patched very quickly, probably wouldn't be worth the effort long-term.


No, this is not possible (as far as is currently known).

The exploit you are referring to is perhaps the Windows Metafile vulnerability. There was also Microsoft Windows Explorer - '.png' Image Local Denial of Service.

These were all Windows exploits. A search on the Exploit Database Archive for "android image" has not found any exploits, while a search for "windows image" has found several.

So no worry for Android - these image exploits are specific to Windows.


As of today, no malware for Android, or one of the popular messengers that exploits images, is publicly known, so you can open images and be fairly certain that nothing bad will happen. All the warnings I saw in the past were just fakes or originated by "scareware" (security scanners which give you false malware reports).

Theoretically it would be possible, here's a scientific paper with a proof of concept from 2014 "Hide Android Applications in Images" by Apvrille/Albertini if you want to know the details. There are also multiple articles which are easier to read about the paper, such as this blog entry. But again, as of today, no malware is knowm that utilized or utilizes images on Android.

  • Please quote the essential parts of the answer from the reference link(s), as the answer can become invalid if the linked page(s) change. Commented Oct 9, 2018 at 20:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .