Objects that are normally handled by helper applications are also assigned sub-user id's by the log-in daemon, the same way as ordinary web pages. When they are interpreted they are bound to the permissions of that sub-user id. This way users don't need to be queried about every arbitrary object they down-load of the net and also don't have to worry about executing possibly malicious code on their machine.
When the interpreter daemon encounters active code embedded in a web page
(by encountering an <APPLET> or <SCRIPT> tag) it spawns
a process to interpret the Java, JavaScript [1], or Perl code.
The new process inherits the permissions of the parent process so the
active code can never escape it's sandbox.