http://weblog.ikvm.net/PermaLink.aspx?guid=bde44d8b-7ba9-4e0e-b3a6-b735627118ff

Suppose you have a third party widget framework that has a class:

package org.example;
public class Widget
{
}

And your application has a subclass of Widget:

package fubar.tech;
public class MyWidget extends org.example.Widget
{
void frob() { ... }
}

The frob() method is package private and you don’t want external code calling it. Now a new version of the widget framework is released that adds a frob method to Widget:

package org.example;
public class Widget
{
public void frob() { }
}

Starting with Java 7 (and this particular behavior is defined by the spec) your package private MyWidget frob() will now override Widget.frob() and hence be callable by anyone who happens to have a reference to your object. If MyWidget.frob() does anything security critical, the third party framework has now introduced a vulnerability in your code.

Quite interesting…

You’ll find additional comments about java inheritence and their non-conformance implementation of Java 7 in the very interesting IKVM.NET Weblog.