Well, it hasn't happened for quite a few years, but it was quite common years ago to get drive by ad malware on up to date systems even. It's the main reason I started turning off JavaScript, and later using ad blockers. I can't imagine it's impossible today.
With Sepctre mitigations rolling out in under a month to almost all PCs, of course there is less incentive to build an exploit. But we know how it was when 90% of PCs were unpatched XP boxes.
