diff --git a/src/com/android/documentsui/picker/PickActivity.java b/src/com/android/documentsui/picker/PickActivity.java index c14c8b8a94f8d82991f96b6e2c908654276e9349..7ed33e2d14c966676ceb1138cd4be31501102aca 100644 --- a/src/com/android/documentsui/picker/PickActivity.java +++ b/src/com/android/documentsui/picker/PickActivity.java @@ -229,6 +229,8 @@ public class PickActivity extends BaseActivity implements ActionHandler.Addons { final Intent moreApps = new Intent(intent); moreApps.setComponent(null); moreApps.setPackage(null); + // Clear the selector to prevent a malicious selector from launching an arbitrary activity. + moreApps.setSelector(null); if (mState.supportsCrossProfile) { if (mConfigStore.isPrivateSpaceInDocsUIEnabled()) { mState.canForwardToProfileIdMap = mUserManagerState.getCanForwardToProfileIdMap(