diff --git a/core/java/android/content/pm/LauncherApps.java b/core/java/android/content/pm/LauncherApps.java
index 36bb5d49666d1..98dd9b3aa30b2 100644
--- a/core/java/android/content/pm/LauncherApps.java
+++ b/core/java/android/content/pm/LauncherApps.java
@@ -781,6 +781,9 @@ public class LauncherApps {
     /**
      * Checks if the activity exists and it enabled for a profile.
      *
+     * <p>The activity may still not be exported, in which case {@link #startMainActivity} will
+     * throw a {@link SecurityException} unless the caller has the same UID as the target app's.
+     *
      * @param component The activity to check.
      * @param user The UserHandle of the profile.
      *
diff --git a/services/core/java/com/android/server/pm/LauncherAppsService.java b/services/core/java/com/android/server/pm/LauncherAppsService.java
index d5089cb41dd4e..c2ac27a5b7378 100644
--- a/services/core/java/com/android/server/pm/LauncherAppsService.java
+++ b/services/core/java/com/android/server/pm/LauncherAppsService.java
@@ -837,7 +837,11 @@ public class LauncherAppsService extends SystemService {
                         PackageManager.MATCH_DIRECT_BOOT_AWARE
                                 | PackageManager.MATCH_DIRECT_BOOT_UNAWARE,
                         callingUid, user.getIdentifier());
-                return info != null;
+                // Note we don't check "exported" because if the caller has the same UID as the
+                // callee's UID, it can still be launched.
+                // (If an app doesn't export a front door activity and causes issues with the
+                // launcher, that's just the app's bug.)
+                return info != null && info.isEnabled();
             } finally {
                 Binder.restoreCallingIdentity(ident);
             }