diff --git a/api/current.txt b/api/current.txt
index 56c152bed257d..c870628917f23 100644
--- a/api/current.txt
+++ b/api/current.txt
@@ -29747,6 +29747,7 @@ package android.os {
     method public android.os.StrictMode.VmPolicy.Builder detectActivityLeaks();
     method public android.os.StrictMode.VmPolicy.Builder detectAll();
     method public android.os.StrictMode.VmPolicy.Builder detectCleartextNetwork();
+    method public android.os.StrictMode.VmPolicy.Builder detectContentUriWithoutPermission();
     method public android.os.StrictMode.VmPolicy.Builder detectFileUriExposure();
     method public android.os.StrictMode.VmPolicy.Builder detectLeakedClosableObjects();
     method public android.os.StrictMode.VmPolicy.Builder detectLeakedRegistrationObjects();
diff --git a/api/system-current.txt b/api/system-current.txt
index 638a4487283ea..a55c13532b213 100644
--- a/api/system-current.txt
+++ b/api/system-current.txt
@@ -32310,6 +32310,7 @@ package android.os {
     method public android.os.StrictMode.VmPolicy.Builder detectActivityLeaks();
     method public android.os.StrictMode.VmPolicy.Builder detectAll();
     method public android.os.StrictMode.VmPolicy.Builder detectCleartextNetwork();
+    method public android.os.StrictMode.VmPolicy.Builder detectContentUriWithoutPermission();
     method public android.os.StrictMode.VmPolicy.Builder detectFileUriExposure();
     method public android.os.StrictMode.VmPolicy.Builder detectLeakedClosableObjects();
     method public android.os.StrictMode.VmPolicy.Builder detectLeakedRegistrationObjects();
diff --git a/api/test-current.txt b/api/test-current.txt
index d463c24e2261b..46adb888f9237 100644
--- a/api/test-current.txt
+++ b/api/test-current.txt
@@ -29856,6 +29856,7 @@ package android.os {
     method public android.os.StrictMode.VmPolicy.Builder detectActivityLeaks();
     method public android.os.StrictMode.VmPolicy.Builder detectAll();
     method public android.os.StrictMode.VmPolicy.Builder detectCleartextNetwork();
+    method public android.os.StrictMode.VmPolicy.Builder detectContentUriWithoutPermission();
     method public android.os.StrictMode.VmPolicy.Builder detectFileUriExposure();
     method public android.os.StrictMode.VmPolicy.Builder detectLeakedClosableObjects();
     method public android.os.StrictMode.VmPolicy.Builder detectLeakedRegistrationObjects();
diff --git a/core/java/android/content/ClipData.java b/core/java/android/content/ClipData.java
index ca3658b1637f6..bc5e986d240bf 100644
--- a/core/java/android/content/ClipData.java
+++ b/core/java/android/content/ClipData.java
@@ -853,7 +853,8 @@ public class ClipData implements Parcelable {
      * @hide
      */
     public void prepareToLeaveProcess(boolean leavingPackage) {
-        prepareToLeaveProcess(leavingPackage, 0);
+        // Assume that callers are going to be granting permissions
+        prepareToLeaveProcess(leavingPackage, Intent.FLAG_GRANT_READ_URI_PERMISSION);
     }
 
     /**
diff --git a/core/java/android/os/StrictMode.java b/core/java/android/os/StrictMode.java
index fd0970ed57591..0da4bd16c6976 100644
--- a/core/java/android/os/StrictMode.java
+++ b/core/java/android/os/StrictMode.java
@@ -240,11 +240,16 @@ public final class StrictMode {
      */
     private static final int DETECT_VM_CLEARTEXT_NETWORK = 0x40 << 8;  // for VmPolicy
 
+    /**
+     * @hide
+     */
+    private static final int DETECT_VM_CONTENT_URI_WITHOUT_PERMISSION = 0x80 << 8;  // for VmPolicy
+
     private static final int ALL_VM_DETECT_BITS =
             DETECT_VM_CURSOR_LEAKS | DETECT_VM_CLOSABLE_LEAKS |
             DETECT_VM_ACTIVITY_LEAKS | DETECT_VM_INSTANCE_LEAKS |
             DETECT_VM_REGISTRATION_LEAKS | DETECT_VM_FILE_URI_EXPOSURE |
-            DETECT_VM_CLEARTEXT_NETWORK;
+            DETECT_VM_CLEARTEXT_NETWORK | DETECT_VM_CONTENT_URI_WITHOUT_PERMISSION;
 
     // Byte 3: Penalty
 
@@ -710,7 +715,7 @@ public final class StrictMode {
             public Builder detectAll() {
                 int flags = DETECT_VM_ACTIVITY_LEAKS | DETECT_VM_CURSOR_LEAKS
                         | DETECT_VM_CLOSABLE_LEAKS | DETECT_VM_REGISTRATION_LEAKS
-                        | DETECT_VM_FILE_URI_EXPOSURE;
+                        | DETECT_VM_FILE_URI_EXPOSURE | DETECT_VM_CONTENT_URI_WITHOUT_PERMISSION;
 
                 // TODO: always add DETECT_VM_CLEARTEXT_NETWORK once we have facility
                 // for apps to mark sockets that should be ignored
@@ -756,7 +761,7 @@ public final class StrictMode {
             }
 
             /**
-             * Detect when this application exposes a {@code file://}
+             * Detect when the calling application exposes a {@code file://}
              * {@link android.net.Uri} to another app.
              * <p>
              * This exposure is discouraged since the receiving app may not have
@@ -798,6 +803,22 @@ public final class StrictMode {
                 return enable(DETECT_VM_CLEARTEXT_NETWORK);
             }
 
+            /**
+             * Detect when the calling application sends a {@code content://}
+             * {@link android.net.Uri} to another app without setting
+             * {@link Intent#FLAG_GRANT_READ_URI_PERMISSION} or
+             * {@link Intent#FLAG_GRANT_WRITE_URI_PERMISSION}.
+             * <p>
+             * Forgetting to include one or more of these flags when sending an
+             * intent is typically an app bug.
+             *
+             * @see Intent#FLAG_GRANT_READ_URI_PERMISSION
+             * @see Intent#FLAG_GRANT_WRITE_URI_PERMISSION
+             */
+            public Builder detectContentUriWithoutPermission() {
+                return enable(DETECT_VM_CONTENT_URI_WITHOUT_PERMISSION);
+            }
+
             /**
              * Crashes the whole process on violation. This penalty runs at the
              * end of all enabled penalties so you'll still get your logging or
@@ -1797,15 +1818,15 @@ public final class StrictMode {
     /**
      * @hide
      */
-    public static boolean vmContentUriWithoutPermissionEnabled() {
-        return (sVmPolicyMask & DETECT_VM_FILE_URI_EXPOSURE) != 0;
+    public static boolean vmCleartextNetworkEnabled() {
+        return (sVmPolicyMask & DETECT_VM_CLEARTEXT_NETWORK) != 0;
     }
 
     /**
      * @hide
      */
-    public static boolean vmCleartextNetworkEnabled() {
-        return (sVmPolicyMask & DETECT_VM_CLEARTEXT_NETWORK) != 0;
+    public static boolean vmContentUriWithoutPermissionEnabled() {
+        return (sVmPolicyMask & DETECT_VM_CONTENT_URI_WITHOUT_PERMISSION) != 0;
     }
 
     /**