Can a hostile script be installed from a web page by itself with out the user password ?

I don`t know where to post this so i`ll ask the question here.
I know that hostile scripts can install themselves in windows but can this occur with Linux Mint or other versions of Linux ? Would the password be needed for it to install itself ? If it can is there any distro that it cannot be done with ? What about rendered files-those hidden in PDF or Image file, if any what kind ?
Mint 19.2 Tina Cinnamom.