Essential Eight AH-ML1.2Web browsers must not execute Java content from the internet
Official control statement
Web browsers do not process Java from the internet.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure web browsers block Java content from the internet to reduce security risks.
What this means in practice
This control is about making sure your web browser doesn't run Java content from the internet, which can be a security risk. If Java content is allowed to run, it could be used by hackers to harm your computer or steal your information. It's like cutting off a potential way for crooks to break into your digital space.
Framework
ASD Essential Eight
Control effect (Control Stack)
Preventative
E8 mitigation strategy
User application hardening
Classifications
N/A
Official last update
N/A
Control Stack last updated
29 Sept 2026
E8 maturity levels
ML1
Why it matters
Allowing Java in web browsers can lead to serious breaches, as attackers exploit it for drive-by downloads and remote code execution.
Operational notes
Regularly audit browser and plugin settings to ensure Java is blocked for internet content, as updates or user changes can re-enable it.
Implementation tips
- IT team should review all web browsers used in the organisation to ensure they don't run Java content by changing browser settings or installing appropriate security add-ons.
- System administrators should disable or remove Java plug-ins from web browsers to prevent Java content from running. This can be done through the browser's settings or group policies.
- Security personnel should use web content filters to block Java content from websites accessed through the internet. This involves setting up rules that prevent Java from being downloaded or executed.
- Office managers should communicate with employees about why Java is disabled on web browsers and the importance of not enabling it. This can be part of a regular security briefing.
Audit / evidence tips
- AskWhat steps have been taken to ensure web browsers do not run Java content?
- Look atCheck browser settings and group policies for any configurations related to disabling Java plug-ins or content
- GoodThere are group policy settings that clearly show Java is disabled across all browsers, and there is documentation or evidence of regular checks being conducted
- AskWhich add-ons or extensions are installed on web browsers that relate to Java?
- Look atReview the list of active extensions or add-ons in the web browsers
- GoodNo active Java-related extensions are found, or they are clearly marked as disabled
- AskHow are employees made aware of the policy regarding Java content?
- Look atCheck for evidence of communication such as memos, emails, or training materials about not using Java content
- GoodDocumented employee communications with clear guidelines against enabling Java in browsers, reinforced by security briefings
Cross-framework mappings
How E8-AH-ML1.2 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.23 | E8-AH-ML1.2 requires that web browsers do not process Java content from the internet to reduce exposure to exploitation via browser-borne... | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
| ISM-1486 | E8-AH-ML1.2 requires that web browsers do not process Java content sourced from the internet | |
open_in_fullBroader than(1)expand_less | ||
| ISM-0961 | E8-AH-ML1.2 requires that web browsers do not process Java content from the internet | |
layersPartially meets(1)expand_less | ||
| ISM-2110 | ISM-2110 requires user applications to be hardened using ASD and vendor guidance, choosing the most restrictive settings when guidance co... | |
sync_altPartially overlaps(1)expand_less | ||
| ISM-0963 | ISM-0963 requires organisations to implement web content filtering to block potentially harmful web-based content | |
extensionDepends on(1)expand_less | ||
| ISM-1585 | E8-AH-ML1.2 requires that web browsers do not process Java content from the internet | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related Essential 8 controls in User application hardening
See all User application hardening controls, or browse the full ASD Essential Eight library.