This has been common place for a while now on standard display advertising where malicious code is run until you leave the page.