>Aren't most or nearly all of the Java exploits related to running sandboxed code? Yes. Memory corruption flaws are still found with some regularity in the JVM

>Aren't most or nearly all of the Java exploits related to running sandboxed code? Yes. Memory corruption flaws are still found with some regularity in the JVM, but they probably represent less than 10-20% of browser security issues.