Vulnerability in the JavaFX component of Oracle Java SE exposes a sandbox bypass that lets an unauthenticated attacker with network reach affect the integrity of data handled by the Java runtime. The flaw permits unauthorized update, insert or delete operations on data accessible to Java applications, indicating an improper access control weakness (CWE‑284). Successful exploitation requires a degree of human interaction with a third party and does not allow for full remote code execution, but the impact on confidentiality is minimal, while the integrity impact can be significant for software relying on the sandbox for protection.

The affected platform is Oracle Java SE 8u491, specifically its client deployments that run sandboxed Java Web Start applications or applets loading untrusted code from the internet. Server deployments that execute only trusted, administrator‑installed code are not impacted. The precise version listing, 8u491, is the only affected build in the product line documented by Oracle.

The CVSS score of 3.1 indicates a low severity, and the EPSS score of less than 1%, combined with its absence from the CISA KEV catalog, suggest a low likelihood of widespread, automated exploitation. The likely attack vector is through network protocols that a sandboxed Java application may use to fetch and execute code; the attacker must also involve a human user who supplies or accepts the malicious content. Because exploitation requires interaction and does not grant full remote code execution, the real world risk is primarily confined to integrity loss for sandboxed deployments, especially where untrusted code is routinely downloaded.