There's a data race accessing java.net.URL.factory static field in getURLStreamHandler() method (used in constructors and readObject()) which can cause incorrect publication of URLStreamHandlerFactory instance. The URL.factory field should be made volatile.