diff --git a/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java b/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java
index a1eae37556ec7..fec63da792c43 100644
--- a/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java
+++ b/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java
@@ -1303,12 +1303,16 @@ public class SelectFileDialog implements WindowAndroid.IntentCallback, PhotoPick
                             return null;
                         }
                         mFilePaths[i] = mUris[i].getSchemeSpecificPart();
-                    } else {
-                        if (ContentResolver.SCHEME_CONTENT.equals(mUris[i].getScheme())
-                                && isContentUriUnderAppDir(mUris[i], mContext)) {
+                    } else if (ContentResolver.SCHEME_CONTENT.equals(mUris[i].getScheme())) {
+                        if (isContentUriUnderAppDir(mUris[i], mContext)) {
                             return null;
                         }
                         mFilePaths[i] = mUris[i].toString();
+                    } else {
+                        // Reject any other scheme (including null). A hostile
+                        // GET_CONTENT handler can otherwise return a bare
+                        // absolute path that bypasses isPathUnderAppDir().
+                        return null;
                     }
 
                     displayNames[i] =