> I don't know how it's done either, and I've heard about them a few times. It seems somewhat unlikely that there is a remote code execution vulnerability being exploited only by adverts that hasn't been urgently fixed by the browsers.

Flash. And there are a lot of unpatched browsers out there. Between the two, there are lots of users vulnerable to malvertising.

An ad blocker doesn't address the whole of the vulnerability space, but it is a significant mitigation.