For one thing, there's no code base called "JavaScript." There's V8, SpiderMonkey, JavaScriptCore, Chakra, and more, and an exploit in one is unlikely to work i

For one thing, there's no code base called "JavaScript." There's V8, SpiderMonkey, JavaScriptCore, Chakra, and more, and an exploit in one is unlikely to work in others. Flash and Java each have a larger market share than any given JavaScript implementation. Java is an interesting case in that the same platform needs to support sandboxed browser applets and desktop/server software. Unlike JavaScript, the designers of Java don't have the ability to simply leave the capability of OS access out of the platform entirely. They rely on a sandbox to keep untrusted code from calling unsafe procedures, and it's the sandbox that failed here.