Publishing an old browser
An unsupported browser with the Java 8 plug-in runs on a session host for each user, so the servers keep an old browser and Java 8, along with the gateway and its patching.
Replace Citrix and VDI for your Java apps
Many organisations keep Citrix, VDI or Remote Desktop Services running only to deliver a Java application, or the old browser and Java plug-in it needs. CheerpJ runs the same application in each user’s own browser, with no session host, display protocol or remote-access gateway in between.
Why Java applications end up on virtual desktops
-
Session hosts keep Java and Internet Explorer alive
Java 8 is the last release with the browser plug-in and Java Web Start, so the application is published from a Citrix, VMware Horizon or Remote Desktop Services session host. For applets it’s often Internet Explorer itself: Microsoft retired it on Windows 10 in 2022, but not on Windows Server.
-
A session host for one application is priced as a platform
Gartner says Citrix sells in bundles that can leave buyers paying for product they don’t want, seldom for less than three years. Each user or device also needs an RDS client access licence, licences for Windows Server 2022 can’t connect to Windows Server 2025 hosts, and the servers are sized for the busiest hour.
Sources: The Register, on Gartner’s DaaS predictions · Microsoft, RDS client access licences
-
The gateway is part of your attack surface
CISA’s Known Exploited Vulnerabilities catalog lists 27 Citrix vulnerabilities, 21 of them in NetScaler ADC and Gateway and seven used in ransomware campaigns. CitrixBleed 2 was added in July 2025 with a one-day deadline to patch, and within weeks at least 100 organisations had been hacked through it.
-
Users feel every round trip
Every click and keystroke travels to the session host and back. Microsoft advises keeping latency under 150 ms, and above 200 ms it might affect user experience. Printing, the clipboard and local files cross the session through redirection policies that security teams often restrict.
Other ways to put a Java application in the browser
Streaming from a server
Server-side and app streaming run the application on a server or Windows host for each active session, so the hosts are sized for concurrent users and Java is patched on them.
A rewrite as a web application
Nothing runs once it’s finished, but the old application stays until the new one reaches parity. Some streaming toolkits migrate screen by screen, which makes them a rewrite programme too.
Two ways to run your applications with CheerpJ
CheerpJ replaces VDI for Java applications, not VDI itself. Keep virtual desktops for full Windows desktops, native Windows applications, or Java applications CheerpJ doesn’t support yet, such as JavaFX interfaces, planned for 2027, SWT applications, or applications that depend on pre-built native libraries.
For your security review
No gateway on the edge
Users open a URL inside your network, so there’s no remote-access gateway or display protocol to expose and patch.
No Java on session hosts
The Java runtime runs inside the browser tab, so no server keeps a Java runtime or an unsupported browser with the Java 8 plug-in.
Your network rules
The application reaches its back-end services under the browser’s security policies and your network controls. Direct database access goes through a Tailscale VPN you can host yourself.
The data reaches the browser
The application runs on the user’s computer, so the data it displays reaches the browser, as with any web application. Where data must never reach the device, keep a virtual desktop.
Get started
Talk to us
Tell us which Java applications you publish through Citrix, VDI or RDS and when your next renewal or host refresh is due, and we’ll help you plan a pilot alongside your current service.
Talk to usTry the extensions
The CheerpJ browser extensions let you try your applications in Chrome or Edge.
Get the browser extensions