When we say that Java applets are vulnerable, what exactly do we mean? A vulnerability in the underlying jre? In the browser? In the "applet" component?
what exactly is exploited?
This would include issues with how the applet is written, such as:
This would include issues with allowing the running of Java applets, such as:
Trying to sandbox the applets is hard, and as such there will be edge cases allowing sandbox escapes. As most of the things that web pages need to do can be done without adding the extra vulnerabilities, it makes sense to try to disable applets, as this reduces the attack surface.