Hacker News Reader

Sounds like you have a bigger problem if your browser isn't properly sandboxed.

ISPs previously did this. Not JS exploits, but they injected ads into HTTP web pages. Really popular ISPs, on the level of Comcast.