Yes, that’s always possible, although I’d say that exploits this serious (zero interaction) are quite rare. One click exploits are already much less powerful for targeted attacks, although can work pretty well for broad attacks.