There is a lot of talk here but no real answers. What exploit is this using to infect Windows computers and Android phones?

Does this have to do with the 0-day exploit in WebP that is causing a huge mess for the entire ecosystem?

Everyone seems to be fixated on "ads shouldn't be able to run JavaScript" and the like.

What exactly is that JavaScript in the ad taking advantage of? Why would it matter that it's an ad and not just a website?

If ads can do it, web pages can do it.