Java has had multiple drive-by exploits discovered in just the past few months, which by definition don't require confirmation.

I was inaccurate, however. Java is almost certainly the cause of most exploits, but I daresay that user inexperience (to put it kindly) is probably the source of most infections. Touchè.