I don't have any flavour of Java installed, but (Mozilla employee) Jesse Ruderman is an impeccable source.

http://www.squarefree.com/2006/10/28/bundled-software-in-security-updates/

"Bundled software in security updates

Today's Java security update includes a checked-by-default "Install Google Toolbar for Internet Explorer" option. Shame on you, Sun and Google. Automatic security updates are no place to push unrelated, bundled software. Making security updates annoying hurts security almost as much as making security updates complicated: users will be less inclined to update next time.

This is similar to how Flash updates attempt to install the Yahoo Toolbar. It's certainly not as bad as the frequently updated AOL Instant Messenger, which turns on the "Today window" popup on every AIM account and adds a "Netscape ISP" icon to the desktop with every security update. But I thought Google was trying to set a good example."

Google's halo slips still further ...

Is that just in since this update? Look at this comment:

http://blogoscoped.com/forum/60018.html#id60268

I don't know, I'm afraid – I don't have Java installed, so I don't know what/how the update is pushed.

But mrbene's comment appears to talk about a new installation (where a default-on bundling is sucky, but users are at least making their initial choices). Whilst Jesse makes the distinction that this is for a security update, which is much more sucky (I believe too, in principle, without the benefit of seeing what's presented to users).

There must be some Sun Java users here?

(The Google Toolbar, of course, silently pushes out its own feature and security updates without user interaction at all – more or less unstoppably, without extraordinary measures. That's not something Microsoft could get away with – even MS/Windows Update can be turned on and off by ordinary users, even the 'compulsory' IE7 update can be controlled by tools they make available – but most people assume the best of Google, and they take advantage of that to redefine 'good' and 'evil').

I've just updated JRE and there was no sign of Google Toolbar installation.