tl;dr malicious Ad stores payload in image. it then executes it with eval()

if publisher had minimal CSP eval protection on Ads it will be safe. but I guess that would break every ad, even Google's.

in the end, same old everything. just a slightly clever way to avoid static analysis, that is also not new at all.