When the CatalogManager configuration of relative-catalogs is false, the catalog paths will be absolute.  When parsing the catalogs in Catalog.parseCatalogFile, the first thing that occurs is creating a URL of the current working directory, which requires a grant to the "user.dir" PropertyPermission.  Creating this URL is unnecessary when an absolute path to the catalog is passed in and the grant would also be unnecessary.

To alleviate this condition, a URL can be attempted to be made from the fileName first and if a MalformedURLException occurs, treat it as a relative path.  In essence:

try {
  base = new URL(fixSlashes(fileName));
} catch (MalformedURLException mue) {
 ...
}

Alternatively, there can be a mode set or passed in to treat the fileName appropriately.