Browsers store web pages in a local cache on the client's machine. How does a hostile Java applet exploit this information to gain more privileges than it is entitled to?
My understanding is that a Java applet can run either in sandbox mode or privileged mode. Only certified applets can run in privileged mode and uncertified ones CAN run in privileged mode but it has to request access from the user. However, this question implies it can use the browsers cache to escalate it's privileges.
The only thing I can think of is that the applet request access via the browser. The user can accept or decline this request and that approval is stored by the browser to determine privileges to the applet. If you could get at that cached data with the applet, you could alter the information and trick the browser into thinking it has been granted privileged access. Therefore allowing the applet to cause damage to the system.