finalize() Method Declared Public

This vulnerability occurs when a Java class declares its finalize() method as public, violating secure coding practices for mobile code.

In Java, the finalize() method is a special method called by the garbage collector before an object is destroyed. Declaring it as public breaks the intended contract, as this method should only ever be invoked automatically by the JVM's garbage collection process, not directly by application code. Explicit calls to finalize() are strongly discouraged and are a common source of errors and unpredictable behavior. For mobile code, such as applets or frameworks where code is downloaded and executed remotely, this flaw becomes a direct security threat. An attacker could exploit the publicly accessible finalize() method to trigger malicious logic, interfere with object cleanup, or cause a denial of service by manually invoking garbage collection routines. The secure practice is to always declare finalize() as protected, and within it, only call super.finalize().