Ads are basically running a program they wrote on your computer. If there’s any exploitable feature in your browser’s JS sandbox, count on someone sending you an ad that will exploit it.