I've been wondering whether viewing a website offline increases the security risk.

The reason why I'm asking is that having been a short time java applet developer (for a small task) I've come to know that a java applet originating from the local file system has more privileges(like accessing the local file system) compared to one that comes from the internet. I don't really know how general this principle is, and whether websites that originate from your hard drive are even considered trusted.

Should I be concerned about a rogue applet coming with a website I download for viewing offline and posing a security risk? How are things with javascript for instance, are the restrictions relaxed there as well?

2 Answers 2


As I understand it, an untrusted Java applet run in the browser is going to be sandboxed, so I don't believe it will have any more access to your system if you download it and run it in your browser locally than if you run it from the originating server, or from your browser cache, at least by design.

However, you should be concerned about Java applets, period. The number of vulnerabilities discovered in the JRE in the last few years is absolutely staggering. It's highly inadvisable to allow Java to run in the browser, so I would suggest that you don't want to run untrusted applets under any conditions.

  • Well, my intention was not to ask specifically about java applets, i gave it as an example. I was thinking more in the lines of Tom Hawkin's answer.
    – enobayram
    Commented May 9, 2013 at 17:38

Whether Java, JavaScript or whatever, you are generally dealing with the Same Origin Policy that allows a page to be composed of more than one file. So there's read access going on there. Even with scriptless HTML you may be able to exfiltrate some information about image sizes and whether files exist. Some browsers will give little warnings when downloading HTML files.

  • Thanks, this is exactly what i had in mind. Does same origin policy give totally free access to my file system to an included Javascript script?
    – enobayram
    Commented May 9, 2013 at 17:40
  • @enobayram No. It governs how a script can interact with objects and scripts from other sites on the page. It has nothing to do with accessing anything outside of the browser.
    – Xander
    Commented May 9, 2013 at 20:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .