The security manager represents a flawed way to do it. It tries to catch up and restrict an application after it already has access to the releveant APIs. Forge

The security manager represents a flawed way to do it. It tries to catch up and restrict an application after it already has access to the releveant APIs. Forget to restrict just one API, and the sandbox can be escaped. Usually, the integration with the security manager requires intimate knowledge of the application. Javascript follows a better approach because it has a small core API. All other APIs have to be explicitly injected and permitted by the host program.