Mike Hearn: You are right, it does not exploit any flaws in Java (just ask permission, download'n'run the malware).