There are still plenty of cleartext HTTP connections from most devices. An attacker only needs one to build the rest of an attack off of, e.g. wait for the brow

There are still plenty of cleartext HTTP connections from most devices. An attacker only needs one to build the rest of an attack off of, e.g. wait for the browser to request http://banners.some-ad-platform.com/12345.html http://banners.some-ad-platform.com/12345.html, spoof a response that redirects to http://<domain-to-execute-javascript-in>/xss.html http://<domain-to-execute-javascript-in>/xss.html, and then spoof the response to that second request with arbitrary JavaScript. There are other factors that can make it less exploitable for a specific attack, like HSTS being enabled for a specific site, but unless you have some kind of host-based firewall that blocks all outbound cleartext connections, there's probably some potential for exploitation.