Java had sandboxing from the beginning. There were some bugs that allowed client code to escape the sandbox, but it wasn't nearly as bad as some people made it

Java had sandboxing from the beginning. There were some bugs that allowed client code to escape the sandbox, but it wasn't nearly as bad as some people made it out to be. I'd dare to guess that Javascript has had more sandbox-escaping bugs than Java has had.