[palmer]

Whether cloud or not, the exploits require hostile code running on the processor. Of course it is possible to download hostile javascript and people do that all day long. But there is always a question whether the javascript engine allows enough control over memory reading to complete the exploit. Also such attacks are relatively easy to block, not just turning off javascript, but limiting it, or even just switching browsers.

In contrast, the code running on virtual servers in the cloud has a lot more power and flexibility to carry off one of these attacks.

[jurroppi1]

“Once systems are updated, we expect the risk to consumer and enterprise users running non-virtualized operating systems will be low,”

Low, but not completely mitigated even after installing a patch.

Drive-by downloads occur and originate even from legitimate sites sometimes (usually through seemingly innocuous ad script).