If a codebase has multiple non-file URLs that have the same underlying URLConnection permission, LoaderHandler does not weed out duplicate permissions, and unfortunately the underlying PermissionCollections are also unlikely to weed out duplicates, with the net result that duplicate permissions checks happen at runtime for each load*Class with that codebase.