Back in the Windows Vista days I got pwned visiting a web site with an infected ad or script or something. It was a no-click exploit – just the act of visiting the page itself got me infected.