Just one example... Any Java application can run a SecurityManager: http://docs.oracle.com/javase/7/docs/api/java/lang/SecurityManager.html http://docs.oracle

Just one example... Any Java application can run a SecurityManager: http://docs.oracle.com/javase/7/docs/api/java/lang/SecurityManager.html http://docs.oracle.com/javase/7/docs/api/java/lang/SecurityM... For instance, Java application servers often have the capability to implement policies per application - so you can run the app server as a privileged user but do things like restrict access to parts of the file system, opening network sockets, using JNI, etc. Essentially this is the same mechanism that applets use to sandbox code. So any exploit that could circumvent this could have an effect outside of the browser, in theory.