...
Additionally, hostile code from any other package can exploit this vulnerability if the class is accessible. (For more information, see CON04-J. Synchronize classes that may interact with untrusted code using a private final lock object.)
...
For more information on using an Object as a lock, see CON04-J. Synchronize classes that may interact with untrusted code using a private final lock object.
...