I don’t know if Google ad networks specifically have been compromised in the past, but it’s certainly happened to networks used by major sites. nytimes.com is o

I don’t know if Google ad networks specifically have been compromised in the past, but it’s certainly happened to networks used by major sites. nytimes.com is one such example. At a minimum, any ad served by a third party network on a site you’re visiting should be considered a security threat. You gotta draw the line somewhere, but I think it’s reasonable to at least consider only first-party content from the site you’re visiting as reasonably safe. Perhaps blocking even JS unless it is absolutely necessary. Any site you visit could be compromised, but since the only 100% safe course of action is to completely disconnect from the web, blocking the most obvious vectors entirely seems appropriate. Of course, not only are ad networks vectors for malware, they don’t even serve a useful purpose to you that might justify the risk.