If you're correct, you've uncovered some 0days in the wild. Go figure out which site, capture what happens, and turn it in to the respective browser developers for a nice bug bounty.

Or, you know, maybe they aren't wasting a 0day on "obviously bad advertisements".