It's just a form of cross site scripting, with a fairly clever vector, and Java instead of Javascript running. Java applets have fairly strict rules about what

It's just a form of cross site scripting, with a fairly clever vector, and Java instead of Javascript running. Java applets have fairly strict rules about what they can access, mainly just back to the site it was hosted from. So the attack would go: 1) your browser opens a malicious java applet, 2) the applet makes a request to change your password, add spammy facebook apps, spam everybody, change your contact email address and request a "forgotten" password, and finally: 3) you lose. This isn't revolutionary, but it's clever and yet another thing to be aware of with user created content.