I'm not sure how much I believe this unless I see video proof (or have it happen on my machine).<p>I see how this might be possible as the ads are loaded via javascript, but the javascript running the ads should be owned by Spotify, not the advertising company, that should just be an image file. Somebody please correct me if I'm wrong.<p>On another note, this statement "Some of them do not even require user action to be able to cause harm." makes me trust this even less. If the ad is opening a new browser window, that browser window is sandboxed. Sure it can ask the user to take an action, but it can't take an action on behalf of the user.<p>Anybody else have insights on this?