All it takes is going to one random website, that embeds ads, that embed an exploit kit. Not a new thing, we had this happen even with popular news sites. So yeah, it is more likely than you think.