Local privilege escalation via uncleared intent selector

Privilege escalation in Google Android 14 through 16 allows local users to launch arbitrary activities with DocumentsUI permissions. PickActivity.setupLayout copies an incoming intent into its app-selection flow without clearing an attacker-controlled selector, so DocumentsUI forwards the selector under its own authority. A locally installed app needs no additional execution privileges or user interaction, and the resulting activity inherits only the permissions available to DocumentsUI.