What does "remotely exploitable" mean, though? What would "authentication" mean, in this context? I think what this must mean is that IF you click through the

What does "remotely exploitable" mean, though? What would "authentication" mean, in this context? I think what this must mean is that IF you click through the various dialogs to enable an applet or Java webstart application to run in your browser (or be launched from it), at that point the running code could do something bad. Perhaps these are ways to escape the normal applet sandbox? And "exploitable without authentication" I guess must be about... what, signed JARs? That's a sort of authentication, and I can't imagine what else this could be talking about. That's not so amazing, really, or even very scary, because the user has to explicitly click at least one (usually more) dialogs before the code will run. On some browsers, there are many more steps involved because Java is disabled by default (and even re-disabled by default if you don't use it for a while), and you have to figure out how to enable it first. On some browsers (like Chrome on OS X) Java simply doesn't work, so it's out of the question. This is where a lack of detail really harms the point -- if they walked through the actual steps involved in using any of these exploits, people would have a much better idea of what was actually at risk. My suspicion is that for anyone who doesn't approve applets on shady sites, the risk is negligible.