can u elaborate on these jvm promises?

The "sandbox" promise was/is still offered as the primary line of defense for Java.

"The first version of Java was released by Sun Microsystems in 1995 [2]. One year later, researchers at Princeton University identified multiple flaws enabling an analyst to bypass the sandbox [3]. The authors identified weaknesses in the language, bytecode and object initialization, to name a few, some of them still present in Java at the time of writing."[0]

[0] https://www.exploit-db.com/papers/45517

[2] http://www.oracle.com/technetwork/java/javase/overview

[3] Drew Dean, Edward W. Felten, Dan S. Wallach. "Java security: From HotJava to Netscape and beyond." In Security & Privacy, IEEE, 1996

The Java sandbox trusted any code signed with a SSL certificate by design, what didn't stop Sun from announcing it was secure and everything.