They use tricks and exploits to escape their sandbox. Browsers have some legitimate uses for 3rd party JavaScript to interact with the page. Malicious ads will obfuscate their code to use APIs in an unintended way.
Sorry I don’t know more specifics, but this is why the FBI recommends you run an ad blocker.