It was in the browser, and it was not running arbitrary code. It used ROP, and was only calling functions already compiled into the browser applet. There's a reason nothing came of it. We want to be able to map memory as executable, but the browser can only map memory as read-write