Index: chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java |
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java |
index c05dd1177d8027d43d56d762be21b5a4967019a3..1ac4ba92c082b6676dda3138c1e31b3fd97b0508 100644 |
--- a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java |
+++ b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java |
@@ -662,9 +662,16 @@ public class IntentHandler { |
// Determine if this intent came from a trustworthy source (either Chrome or Google |
// first party applications). |
boolean isInternal = isIntentChromeOrFirstParty(intent, context); |
- |
- // "Open new incognito tab" is currently limited to Chrome or first parties. |
- if (!isInternal |
+ boolean isFromChrome = wasIntentSenderChrome(intent, context); |
+ |
+ // "Open new incognito tab" is currently limited to Chrome. |
+ // |
+ // The pending incognito URL check is to handle the case where the user is shown an |
+ // Android intent picker while in incognito and they select the current Chrome instance |
+ // from the list. In this case, we do not apply our Chrome token as the user has the |
+ // option to select apps outside of our control, so we rely on this in memory check |
+ // instead. |
+ if (!isFromChrome |
&& IntentUtils.safeGetBooleanExtra( |
intent, EXTRA_OPEN_NEW_INCOGNITO_TAB, false) |
&& (getPendingIncognitoUrl() == null |