system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5: How can malware get installed on your computer just by openning up a website and without the user getting notified about a download?
gpt
Malware is mostly spread through security vulnerabilities on your computer,
for example in your browser or some plugins your browser uses.

The most common ways for an infection are through JavaScript or the Flash
plugin. Someone might find a bug in Adobe Flash to manipulate it into running
arbitrary code. Using this bug, he downloads the real malware to your computer
and executes it. Since this still requires you to visit a website that serves
the exploit and quite sure you won't visit some site like
askdhfawej92nd09a32nd.com too often, there is often another step in the whole
attack campaign like hacking a advertisement network and serving the exploit
code via advertisements. This way every website that includes ads from the
hacked network, will serve the malware (that's why we love ad blockers ;)).
Another way to spread the exploit are so called Cross-Site-Scripting
vulnerabilities in websites where a attacker can inject JavaScript code in a
website that will get executed when a user visits the website.

But using vulnerabilities in your browser or the plugins aren't the only ways
to infect your computer. Another way that was described not to long ago but
only in theory (never seen in the wild) was to infect Fedora Linux using the
fact that Google Chrome will download files without prompting the user and
Fedora will automatically index the downloaded files and create for example
preview images for pictures or video files to show in your file manager. A
attacker could cause Chrome to download a manipulated media file, that would
be stored on the disk and processed by the multimedia engine used by Fedora
(called gstreamer). Due to a bug in gstreamer, when processing the manipulated
media file, the attacker could execute code on the computer.

All in all, to infect a computer without user interaction the attacker needs a
vulnerability in any program you use or multiple minor bugs combined in a
clever way.