We see two types of Java web-based applications:

  1. Simple applications, asking to be allowed (Yes/No) to use the microphone, etc.

  2. Heavy, complete applications, asking to Allow/Block (like online Youtube downloaders, etc.)

Are both of them a serious security threat for users?

closed as too broad by D.W., S.L. Barth, grochmal, Xander, crovers Jan 5 '17 at 21:17

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I think both of your questions could be combined into a single concept covering client-side code being run, else you will end up asking about each individual technology. – schroeder Dec 31 '16 at 9:31

Java exploitation: I think the most popular way to exploit systems with almost zero effort is with malicious Java applets. Used in conjunction with social engineering - almost every person instinctively clicks the 'Run applet' dialog. Even if you don't look at attacks involving SE, there are always exploits for the Java Browser Plugin freely available (IIRC, Oracle was phasing out the plugin. Don't remember the current status. Might be worth a look for you.)

tl;dr: Yes. All of these are possible attack vectors, either in combination with SE or through exploitation of unpatched systems or usin private exploits.

Just copied this over from your other Q.

Not the answer you're looking for? Browse other questions tagged or ask your own question.