The extension mechanism is proposed to be dropped in JDK 9. See JDK-8060206. The default Policy implementation includes support for granting permissions to standard extensions, and these extensions used to be granted AllPermission by default (which has since been removed). The Policy guide (http://docs.oracle.com/javase/8/docs/technotes/guides/security/PolicyFiles.html) needs to be updated:

In "Default Policy File Locations", change:

"The java.policy file installed with the JDK grants all permissions to standard extensions, allows anyone to listen on un-privileged ports ..."

to:

"The java.policy file installed with the JDK allows anyone to listen on un-privileged ports ..."

That is the only guide so far I have found that needs to be updated, but if I find others, I will update this bug.