Sorry, not going to set up a custom runtime for an editor. Note the "giant runtime" concern I put first.

I'd use the system java/browser which has an extension available, no need to scan. FF just enabled javascript for everyone without their permission, and Chrome does plenty of shady things. The fewer software installed, the better. I prefer to stay far away from potential security problems, with multiple hurdles whenever possible. If it makes you feel better I don't install flash or ruby either unless the situation calls for it.