defender and html files

Hi,

One of my new clients has several html files in his media gallery. Can defender scan those for malware as well? Is there any way to execute bad code form a HTML or is he ok on that front?

Corn