[immibis]

ISPs previously did this. Not JS exploits, but they injected ads into HTTP web pages. Really popular ISPs, on the level of Comcast.