Security guidance says to remove software you don’t need, and desktop Java stays installed only because a few business applications need it. CheerpJ runs those applications inside the browser, so desktop administrators can uninstall Java, the plug-in and IE mode instead of patching them.
Java isn’t part of Windows or macOS, so it is there because of applets such as Oracle Forms and E-Business Suite, Java Web Start applications and in-house Swing or AWT applications. Oracle removed the plug-in and Web Start from Java 11, so applets and Web Start keep those computers on Java 8.
The UK’s NCSC calls browser plug-ins such as Java “one of the top ways that users devices are compromised”. Australia’s Essential Eight, CIS Controls v8 and CERT/CC all say to disable or remove Java unless an application really needs it.
In 2026 Oracle’s four quarterly updates fixed 105 vulnerabilities in Java SE, 80 of them remotely exploitable without authentication, including 55 in October alone. Each one is a new runtime to package, test and push to every desktop.
Source: Tenable, Oracle’s October 2026 Critical Patch Update
CISA’s Known Exploited Vulnerabilities catalog lists 13 vulnerabilities in Oracle’s Java SE and JRE, six of them used in ransomware campaigns. All date from 2010 to 2016, so a forgotten Java 8 installation stays exploitable for as long as it stays on the computer.
Java 8 stays on every desktop, on Oracle’s latest security updates, along with Exception Site Lists and Deployment Rule Sets. If the signed rule set becomes invalid, “all RIAs are blocked”, so an expired certificate can stop every legacy application at once.
It works only for standalone applications, not applets, and each private runtime has to be inventoried and patched, following the vendor’s updates rather than OpenJDK’s.
Publishing it through Citrix or VDI, or streaming its interface from a server, moves Java onto servers that still need patching, with capacity and cost that grow with the number of users.
The application runs inside the browser’s sandbox, where Java code can’t start processes, load native binaries or reach the local disk.
Files leave only as browser downloads and enter only as user uploads.
CheerpJ makes no connection to Leaning Technologies and opens no new ports, so it runs on air-gapped networks.
Self-hosted releases are versioned files that never update themselves, so you choose when to test and deploy each one.
Case study As part of a wider IT and cybersecurity initiative, CF Fertilisers removed Java 8 from every user computer at its UK and US sites, while continuing to use Oracle E-Business Suite.
Tell us which applications still need Java on your users’ computers, and we’ll help you test the most critical one first, with Java left in place until users have moved.
Talk to usThe CheerpJ browser extensions let you try your applications in Chrome or Edge.
Get the browser extensions