<i>Exploits in jpg&#x2F;png are very rare.</i><p>A major security issue with probably the most popular automated image processing toolkit in existence came to light just the other day. That particular one would be used for attacking servers, but there have been client-side vulnerabilities in other common resources such as fonts before too. Assuming that just because a format is common the software processing it won&#x27;t introduce any vulnerabilities is not a great idea.<p>In any case, the relative rarity isn&#x27;t really the point. Either it&#x27;s ethically and&#x2F;or legally correct to assign blame for malicious advertising to the final host site that the user actually visits, or it isn&#x27;t. That&#x27;s the principle we&#x27;re really debating, and the rest is just a degree of risk.