After support of applets and webstart was removed the next spec and implementation in the java.awt.Desktop.browse(URI) became outdated:

508 * <p>
 509 * If the calling thread does not have the necessary permissions,
 510 * and this is invoked from within an applet,
 511 * {@code AppletContext.showDocument()} is used. Similarly, if the calling
 512 * does not have the necessary permissions, and this is invoked from within
 513 * a Java Web Started application, {@code BasicService.showDocument()}
 514 * is used.


523 * @throws SecurityException ..... and not invoked from within an applet or Java Web Started
 528 * application
 529 * @throws IllegalArgumentException if the necessary permissions
 530 * are not available and the URI can not be converted to a {@code URL}


In fact we should rollback this fix:
https://bugs.openjdk.java.net/browse/JDK-6439864
https://bugs.openjdk.java.net/browse/CCC-6439864