There is an oversight in the fix for 6675802. It allows a malicious applet to show an always-on-top popup menu which has the whole screen size. A code example is below:
=== Source Begin ===
import javax.swing.*;
import java.awt.*;

public class MaliciousApplet extends JApplet {
    public void start() {
        JPopupMenu popupMenu = new JPopupMenu();
        popupMenu.add(new JMenuItem("Click"));

        Dimension screenSize = Toolkit.getDefaultToolkit().getScreenSize();
        popupMenu.setPopupSize(screenSize);

        popupMenu.show(null, 0, 0);
    }
}
=== Source End ===
Posted Date : 2008-04-21 16:20:36.0

There are no workarounds.

The changes in the Popup class added by the fix for 6580930 were intended for allowing a popup menu to overlap the Windows task bar. It is important for tray icons. However, popup menus in applets don't need to overlap the task bar. Hence, setAlwaysOnTop() in the Popup class can be called only for applications, but not for applets.

The fix idea is to avoid calling setAlwaysOnTop() in the Popup class for applets, but do it for standalone applications.
Posted Date : 2008-04-21 16:20:36.0

In general it is not easy to determine whether one is running in the context of an applet as opposed to an application.
Posted Date : 2008-04-21 16:34:57.0

OK, we can always try to do setAlwaysOnTop() and catch the exception for applets. I think, it shouldn't slow down the code noticeably.
Posted Date : 2008-04-22 08:33:23.0