diff --git a/src/com/android/documentsui/picker/PickActivity.java b/src/com/android/documentsui/picker/PickActivity.java index e9b91b1a075acc244b832c1cf52e357109f0f20e..5eccd1e3bf21b1c129453a3c0673f8031c9e1551 100644 --- a/src/com/android/documentsui/picker/PickActivity.java +++ b/src/com/android/documentsui/picker/PickActivity.java @@ -230,6 +230,8 @@ public class PickActivity extends BaseActivity implements ActionHandler.Addons { final Intent moreApps = new Intent(intent); moreApps.setComponent(null); moreApps.setPackage(null); + // Clear the selector to prevent a malicious selector from launching an arbitrary activity. + moreApps.setSelector(null); if (mState.supportsCrossProfile) { if (mConfigStore.isPrivateSpaceInDocsUIEnabled() && SdkLevel.isAtLeastS()) { mState.canForwardToProfileIdMap = mUserManagerState.getCanForwardToProfileIdMap(