it would be a website owner suing the ad company for modifying their site, or something to that effect.
If the ISP is the one doing the injection without the knowledge of either party, the ISP would be the one who would get hauled into court by the website for creating the association without authorization. The advertiser could very well sue the ISP for the exact same reasons, too.
·