Dissecting The CVE-2013-2460 Java Exploit

**Executive summary:** This report documents a Java sandbox bypass via the vulnerable sun.tracing.ProviderSkeleton.invoke implementation: exploit code uses Class.forName and MethodHandles.Lookup to load internal Rhino classes, define a malicious ClassLoader, and set the SecurityManager to null, enabling privileged actions; the write-up includes a Flashpack exploit-kit sample, Java/JavaScript deobfuscation steps, and a YARA signature for detection.