A threat detection method and apparatus, and a network system are disclosed, which relate to the field of computer technologies, and can resolve a missed detection problem of a Web sandbox in a delay loading scenario. The method includes: when loading a URL in a browser of a Web sandbox, obtaining page code of a first display page group identified by the URL and an overall size occupied by the first display page group in a display area of the browser; injecting preset dynamic code into the page code of the first display page group; parsing and executing the page code that is of the first display page group and that includes the preset dynamic code; sending a request message when detecting that a value of a display variable is greater than or equal to a preset value, to request to obtain page code of a second display page group; receiving a response message that carries the page code of the second display page group; and detecting, in the Web sandbox, whether the page code of the second display page group carries attack code.