The security of Oracle's Java software framework, installed on some three billion devices worldwide, is taking a turn for the worse, thanks to an uptick in attacks targeting vulnerabilities that will never be patched and increasingly sophisticated exploits, security researchers said.

The most visible sign of deterioration is in-the-wild attacks exploiting unpatched vulnerabilities in Java version 6, Christopher Budd, threat communications manager at antivirus provider Trend Micro, wrote in a blog post published Tuesday. The version, which Oracle stopped supporting in February, is still used by about half of the Java user base, he said. Malware developers have responded by reverse engineering security patches issued for Java 7 and using the insights to craft exploits for the older version. Because Java 6 is no longer supported, those same flaws will never be fixed.

"This is a large pool of vulnerable users who will never be protected with security fixes and so [they're] viable targets for attack," Budd said.

He went on to cite the recent bundling of the JAVA_EXPLOIT.ABC trojan in the Neutrino Exploit Kit, a software tool available on the Internet that streamlines the development of exploits. JAVA_EXPLOIT.ABC exploits the CVE-2013-2463 vulnerability that Oracle fixed in Java 7 two months ago.

The other dynamic causing the decline in Java security is the increase in ever-more-sophisticated exploits that target a much lower level of the Oracle software platform, known as the Java native layer. Trend Micro researchers described the maturing of this technique in a blog post a couple weeks ago.