Hacker News Reader

What about embbedding iframes?

In which case, I woner why more sites (or evil ads via an ad network) don't attack our home routers?

Probably because it isn't really necessary — it's easier just to own the user's PC the old-fashioned way.