I will note there are definitely Java-accessible extensions with evil potential. My CSE470 group decided to use one of these, the apparently generally evil (some mark it as spyware IIRC) Wildtangent plugins, cos it allowed us hardware-accelerated 3D on a Windows box.