So there's plenty of bugs in the JS interpreters, and you can use those to do regular exploits and run arbitrary code. Separately is escaping the sandbox due t

So there's plenty of bugs in the JS interpreters, and you can use those to do regular exploits and run arbitrary code. Separately is escaping the sandbox due to a bug in the verification. JS is probably far easier to secure, since all the APIs are "safe" to call. That is, there isn't a huge JS stdlib that needs to be restricted. Like brainfuck-there's no way to make dangerous calls. Whereas Java has a huge stdlib that's accessible, so you're fighting an uphill battle to lock it down.