It's simple. Java inventors/developers once said: this new language is entirely safe because it runs on a virtual machine and prohibits any insecure operations,

It's simple. Java inventors/developers once said: this new language is entirely safe because it runs on a virtual machine and prohibits any insecure operations, maybe a bit slow, but now we will finally get rid of all the buffer overruns and similar security breaches that we were so used to with the good old C/C++. It's safe now! And here we go again, exploits are routinely found in what used to be the totally safe and isolated environment. C/C++ can be safe and reliable as well, except infrequent bugs and exploits — you cannot absolutely get rid of bugs, because what involves the humans will never be solved at 100%. But in this case Java and native code appear the same from the security perspective: exploits are found here and there. What's the point of Java then entirely? What does it give except slowdown, memory consumption and restrictions? Personally I believe the only proper way to implement security isolation is with hardware support. Native/sandboxed/virtual machine — does not matter, It is proven now by Java's fail.