The class specification of java.awt.Composite says
 * Since this interface must expose the contents of pixels on the
 * target device or image to potentially arbitrary code, the use of
 * custom objects which implement this interface when rendering directly
 * to a screen device is governed by the {@code readDisplayPixels}
 * {@link AWTPermission}. The permission check will occur when such
 * a custom object is passed to the {@code setComposite} method
 * of a {@code Graphics2D} retrieved from a {@link Component}.


This text is obsolete since permissions are no longer checked because the SecurityManager
cannot be enabled after JEP 486 was integrated