As of Java 7u45 an applet will display a warning message (even if signed with a trusted cert) if a webpage tries to interact with it via javascript and that page isn\'t list
This will be fixed in a future release, according to the oracle blog post:
https://blogs.oracle.com/java-platform-group/entry/7u45_caller_allowable_codebase_and
They recognize the error "Both of these attributes should work together to support the various versions of client installations". But for now, their solution is: "The current work-around would be to favor using Caller-Allowable-Codebase over the old Trusted-Library call. "