> note I don't have their paper) they say they don't need any heightened
  > Java privileges. What's a little confusing here is exactly how
  > they are getting past same-origin issues.

They don't need same-origin. Juliano confirmed this to me a couple of days ago. And the leaked paper shows how they do it.

http://news.ycombinator.com/item?id=3032278

Edit: Either I got copy-paste fat fingers or he changed the blog post; but I did copy that part from somewhere...