
Javascript (which has NOTHING to do with Java) is considered relatively safe. There is a lot of confusion about Java, because most people's introduction to Java was as a browser extension.

Although some/all of these have evolved over time and added sandbox features, they've also been historically buggy, and hackers have from time to time figured out ways to break out of any sandboxes. As are Flash, Silverlight, and any browser extension that allows a random website to download code that can access your local filesystem outside of a sandbox. Java BROWSER EXTENSIONS are considered unsafe. With ANY desktop application, regardless of language, you need to decide if you trust the publisher.

It's as safe/unsafe as any programming language/library/runtime system.

Java is a programming language, library, and runtime system.
