I think you misunderstood what I'm talking about here. [ App (Java -> Dvorak) ]--. >--- Same CPU [ Web Browser with JS ]--`

I think you misunderstood what I'm talking about here. [ App (Java -> Dvorak) ]--. >--- Same CPU [ Web Browser with JS ]--` My argument wasn't about "it" running in a web browser. I was arguing that side-channel attacks that can be exploited from a browser on the same CPU (as per djb's AES cache attack paper) are pretty bad, considering "trick user into opening a webpage" is a pretty low-hanging fruit attack vector.