content: https://arstechnica.com/information-technology/2017/05/windows-defender-nscript-remote-vulnerability/ tldr: windows defender scans to find malware and executes said malware through the exploit... it can happen with visiting websites as much as just receiving emails.