The following public classes in packages exported by java.base are not subclassable (have only private constructors), but are not marked final.

Since none of these top-level classes have subclasses in their nested classes, these can trivially be marked final:

java.lang.invoke.MethodHandleProxies
java.lang.invoke.MethodHandles
java.lang.Runtime
java.nio.charset.CodingErrorAction
java.nio.charset.CoderResult
java.lang.constant.DynamicCallSiteDesc
java.lang.reflect.Modifier
java.lang.runtime.ObjectMethods
java.lang.runtime.SwitchBootstraps
java.net.URLDecoder
java.net.URLEncoder
java.security.DrbgParameters
java.util.Base64
java.util.Collections
java.util.FormattableFlags
java.util.concurrent.Executors
java.util.concurrent.locks.LockSupport

By extending the search to include classes with at-most package-private constructors, we find the following classes:

java.net.InterfaceAddress
java.lang.module.ModuleDescriptor
java.lang.Package
java.io.OptionalDataException