A threat detection method applying to a delay loading scenario, the method comprising: when loading a uniform resource locator, URL, in a browser of a Web sandbox, obtaining, by a threat detection apparatus from a Web server, page code of a first display page group identified by the URL and an overall size occupied by the first display page group in a display area of the browser, wherein the page code of the first display page group comprises monitoring code, the monitoring code is used to obtain and monitor a value of a display variable, and the value of the display variable is used to represent a size occupied, in the display area of the browser, by display pages that have been displayed from a start location of a first display page to a current display page in the first display page group; injecting, by the threat detection apparatus, preset dynamic code into the page code of the first display page group, wherein the preset dynamic code is used to trigger switching from the current display page to a next display page of the current display page; parsing and executing, by the threat detection apparatus, the page code that is of the first display page group and that comprises the preset dynamic code, and displaying, in a sequential manner, display pages in the first display page group; sending a request message to the Web server if the threat detection apparatus detects, by using the monitoring code, that the value of the display variable is greater than or equal to a preset value, wherein the request message is used to request to obtain page code of a second display page group from the Web server, a first display page in the second display page group is a next display page of a last display page in the first display page group, and the preset value is greater than or equal to a size occupied by the first display page in the first display page group in the display area of the browser and less than the overall size occupied by the first display page group in the display area of the browser; receiving, by the threat detection apparatus, a response message sent by the Web server, wherein the response message carries the page code of the second display page group; and detecting, by the threat detection apparatus in the Web sandbox, whether the page code of the second display page group carries attack code. when loading a uniform resource locator, URL, in a browser of a Web sandbox, obtaining, by a threat detection apparatus from a Web server, page code of a first display page group identified by the URL and an overall size occupied by the first display page group in a display area of the browser, wherein the page code of the first display page group comprises monitoring code, the monitoring code is used to obtain and monitor a value of a display variable, and the value of the display variable is used to represent a size occupied, in the display area of the browser, by display pages that have been displayed from a start location of a first display page to a current display page in the first display page group; injecting, by the threat detection apparatus, preset dynamic code into the page code of the first display page group, wherein the preset dynamic code is used to trigger switching from the current display page to a next display page of the current display page; parsing and executing, by the threat detection apparatus, the page code that is of the first display page group and that comprises the preset dynamic code, and displaying, in a sequential manner, display pages in the first display page group; sending a request message to the Web server if the threat detection apparatus detects, by using the monitoring code, that the value of the display variable is greater than or equal to a preset value, wherein the request message is used to request to obtain page code of a second display page group from the Web server, a first display page in the second display page group is a next display page of a last display page in the first display page group, and the preset value is greater than or equal to a size occupied by the first display page in the first display page group in the display area of the browser and less than the overall size occupied by the first display page group in the display area of the browser; receiving, by the threat detection apparatus, a response message sent by the Web server, wherein the response message carries the page code of the second display page group; and detecting, by the threat detection apparatus in the Web sandbox, whether the page code of the second display page group carries attack code.