Your mistake is in conflating Java with the browser. The two are unrelated. Neither is really built with the other in mind, their development is not integrated

Your mistake is in conflating Java with the browser. The two are unrelated. Neither is really built with the other in mind, their development is not integrated or synchronized in any way, and the paradigms are just generally incompatible. And now, one poses a clear and present danger to the security of the other. If you had a Java application, you would not have a problem. If you had a web application, you would not have a problem. If you had a C or C++ application built against either native Windows APIs or a mature cross-platform toolkit, you would not have a problem. Instead, you rely on browsers continuing to put their users at risk by automatically running code in a constantly-leaking sandbox managed by a company that doesn't give a shit. Understand this: Java is a hole in the defenses of modern web browsers. It is behind. Way behind. And it will remain so forever. It and its owner are not up to the task of dealing with the modern web. So yes, you're going to be fighting a constant battle so long as you insist on relying on what everybody already knew was crap in the mid-90s. Or you could just tell your users to click the magic button.