Java actually has a pretty decent security model. Like most sandboxes it was (and still is) full of holes, but browsers don't fare much better.