--- a/jaxp/src/com/sun/org/apache/xerces/internal/utils/ObjectFactory.java	Wed Jul 05 19:50:06 2017 +0200
+++ b/jaxp/src/com/sun/org/apache/xerces/internal/utils/ObjectFactory.java	Wed Jan 15 17:11:43 2014 -0800
@@ -38,7 +38,8 @@
     //
     // Constants
     //
-    private static final String DEFAULT_INTERNAL_CLASSES = "com.sun.org.apache.";
+    private static final String JAXP_INTERNAL = "com.sun.org.apache";
+    private static final String STAX_INTERNAL = "com.sun.xml.internal";
 
     /** Set to true for debugging */
     private static final boolean DEBUG = isDebugEnabled();
@@ -174,12 +175,8 @@
     public static Class findProviderClass(String className, boolean doFallback)
         throws ClassNotFoundException, ConfigurationError
     {
-        if (System.getSecurityManager()!=null) {
-            return Class.forName(className);
-        } else {
-            return findProviderClass (className,
+        return findProviderClass (className,
                 findClassLoader (), doFallback);
-        }
     }
     /**
      * Find a Class using the specified ClassLoader
@@ -192,7 +189,8 @@
         //restrict the access to package as speicified in java.security policy
         SecurityManager security = System.getSecurityManager();
         if (security != null) {
-            if (className.startsWith(DEFAULT_INTERNAL_CLASSES)) {
+            if (className.startsWith(JAXP_INTERNAL) ||
+                    className.startsWith(STAX_INTERNAL)) {
                 cl = null;
             } else {
                 final int lastDot = className.lastIndexOf(".");
@@ -204,7 +202,7 @@
         Class providerClass;
         if (cl == null) {
             //use the bootstrap ClassLoader.
-            providerClass = Class.forName(className);
+            providerClass = Class.forName(className, false, ObjectFactory.class.getClassLoader());
         } else {
             try {
                 providerClass = cl.loadClass(className);