I think there have been cases in the past, but that hardly matters. When you visit a site you run the risk that it has been exploited to spread malware. Would you want to also run the risk that one (or more likely a dozen) other sites running code on that page have been exploited as well?

I don’t know if Google ad networks specifically have been compromised in the past, but it’s certainly happened to networks used by major sites. nytimes.com is one such example. At a minimum, any ad served by a third party network on a site you’re visiting should be considered a security threat. You gotta draw the line somewhere, but I think it’s reasonable to at least consider only first-party content from the site you’re visiting as reasonably safe. Perhaps blocking even JS unless it is absolutely necessary.

Any site you visit could be compromised, but since the only 100% safe course of action is to completely disconnect from the web, blocking the most obvious vectors entirely seems appropriate. Of course, not only are ad networks vectors for malware, they don’t even serve a useful purpose to you that might justify the risk.

Imgur had a couple of periods were trojans were being delivered through ads. The ineptitude of that place was staggering as it happened multiple times from 2010-2015 at least.

Not sure how todays safety is in that regard.

Conceptually, yes. Big vendors in this space have teams to detect malicious activity in their advertising network, but any team that claims to detect 100% is merely detecting 100% of what they know of.

Browsers have gotten better and updates have gotten much faster, so less of that is drive by virus infections by exploiting the browser, but there's still cases of "Pick some users that you think are (a) real users and (b) naive enough" and serve them a exe download that contains a virus.

This is part of the reason the Google Safe Browsing project was created. At the time there were a lot of malicious sites either trying to get high SEO or paying for ads. The goal was to make it safe(r) to go to google and search (and click!) on things.

For a project that didn't directly make money (there are some 'cloud' offerings now), Safe Browsing probably was a very high return on investment.

I've instructed all of my users to never, ever, click on a Google ad when they've searched for something. Its been a couple of years now since someone has shown be a screen with a tech support scam on it.

I had one user that was hitting tech support scams monthly. He would go to Google, search for Amazon, then click the first link on the page (which always had the little Ad word next to it).

Why risk it, I suppose.