diff --git a/services/core/java/com/android/server/am/ActivityStackSupervisor.java b/services/core/java/com/android/server/am/ActivityStackSupervisor.java
index 0b6f7d155d179..9240b84ebcdd2 100644
--- a/services/core/java/com/android/server/am/ActivityStackSupervisor.java
+++ b/services/core/java/com/android/server/am/ActivityStackSupervisor.java
@@ -705,6 +705,10 @@ public final class ActivityStackSupervisor implements DisplayListener {
                 profileFile, profileFd, userId);
 
         ActivityContainer container = (ActivityContainer)iContainer;
+        if (container != null && (aInfo.flags & ActivityInfo.FLAG_ALLOW_EMBEDDED) == 0) {
+            throw new SecurityException(
+                    "Activities launched in ActivityContainers must set allowEmbedded=\"true\"");
+        }
         synchronized (mService) {
             int callingPid;
             if (callingUid >= 0) {