Desktop.browse() will run a program if the URI is a filename while the documentation says that the default browser will be used to open the URI.
This issue has been addressed in the following products: OPENJDK ELS 11.0.30 Via RHSA-2026:0849 https://access.redhat.com/errata/RHSA-2026:0849
OpenJDK-8 upstream commit: https://github.com/openjdk/jdk8u/commit/ec791e5f7dbd914b29163d659e3294b51aee5304 OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u/commit/dc859303a786e641a07a928c3d1bb658134d567d OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/69985a23f025407c7e704bf55ba3b53f4f455c5c OpenJDK-21 upstream commit: https://github.com/openjdk/jdk21u/commit/e3e7c892c2e4b3372b4d02893a5062d429c5db43 OpenJDK-25 upstream commit: https://github.com/openjdk/jdk25u/commit/74edca3660e2dbb2b38e1ebd3fcfd2c6b4247130
This CVE was fixed in Oracle Java SE 8u481, 11.0.30, 17.0.18, 21.0.10, 25.0.2. https://www.oracle.com/java/technologies/javase/8u481-relnotes.html#R180_481 https://www.oracle.com/java/technologies/javase/11-0-30-relnotes.html#R11_0_30 https://www.oracle.com/java/technologies/javase/17-0-18-relnotes.html#R17_0_18 https://www.oracle.com/java/technologies/javase/21-0-10-relnotes.html https://www.oracle.com/java/technologies/javase/25-0-2-relnotes.html