I am not quite sure how they got to running JS on victim's browser in the first place? I would guess any JS being loaded is from ad network. I know IE had this

I am not quite sure how they got to running JS on victim's browser in the first place? I would guess any JS being loaded is from ad network. I know IE had this vulnerability where it would ignore MIME type and would guess file type from content (so attacker could server a specially crafted image which would be interpreted as JS), but that should be long patched... Or did they act as an ad network themselves?