My understanding was that the concern wasn't necessarily that the jvm was insecure, or the browser was insecure (although they've all had vulberabilities at one

My understanding was that the concern wasn't necessarily that the jvm was insecure, or the browser was insecure (although they've all had vulberabilities at one time or another) it was the integration between the jvm and the browser that was difficult/impossible to get right. This not only held for Java but any browser plugin (flash, silverlight). The entire concept was just bad. Now where webassembly comes in is a compilation target for anything to the browser. I had the sorry misfortune of working on a project that had an applet that interacted extensively with the host page. It was excruciating, the api's were not up to the task. At the time, before the canvas tag, that's the length we had to go to get "advanced" functionality into a page. Nowadays that could all be done with js (or X compiled to webassembly) and canvas element. Things evolve.