In what way could Java applets pose a security threat?

The transport mechanism of applets themselves did not typically interrupt the secure distribution of web pages; the security threat lay in the execution of the applet's code, not its transmission.

Java interpreters (JVMs) were designed with a security manager and a sandbox model specifically to limit the system access that untrusted applets could have, although vulnerabilities in this mechanism could be exploited.

Java applets were executable code downloaded from untrusted sources on the internet and run locally within a browser's Java Virtual Machine (JVM). Despite the JVM's sandbox security model, vulnerabilities or exploits in the JVM could allow malicious applets to escape the sandbox and attempt intentional attacks on the user's local system, leading to data theft, system compromise, or other malicious activities.

Java does perform bytecode verification at runtime to ensure type safety and prevent malicious code from breaking out of the sandbox, along with other safety mechanisms; the issue arose from potential bypasses or exploits of these mechanisms.