A zero-day vulnerability in Java 7 can be exploited through any browser running on any operating system — from Windows and Linux to OS X — that has Java installed, security experts said today.