Which class is the system default ClassLoader?

The default ClassLoader is sun.misc.Launcher$AppClassLoader (which is fairly irrelevant in itself) which extends java.net.URLClassLoader. The reverse (superclasses below subclasses) inheritance map of the default ClassLoader:

sun.misc.Launcher$AppClassLoader
  |
  +-- java.net.URLClassLoader
    |
    +-- java.security.SecureClassLoader
      |
      +-- java.lang.ClassLoader
        |
        +-- java.lang.Object

Thus, to examine the security capabilities of the default ClassLoader, check JavaDoc for the java.security.SecureClassLoader and java.net.URLClassLoader.