diff --git a/src/com/android/mail/compose/ComposeActivity.java b/src/com/android/mail/compose/ComposeActivity.java
index f8a3ce8..d171e57 100644
--- a/src/com/android/mail/compose/ComposeActivity.java
+++ b/src/com/android/mail/compose/ComposeActivity.java
@@ -1914,6 +1914,15 @@
     }
 
     /**
+     * @return the authority of EmailProvider for this app. should be overridden in concrete
+     * app implementations. can't be known here because this project doesn't know about that sort
+     * of thing.
+     */
+    protected String getEmailProviderAuthority() {
+        throw new UnsupportedOperationException("unimplemented, EmailProvider unknown");
+    }
+
+    /**
      * Helper function to handle a list of uris to attach.
      * @return the total size of all successfully attached files.
      */
@@ -1922,7 +1931,7 @@
         for (Uri uri : uris) {
             try {
                 if (uri != null) {
-                    if ("file".equals(uri.getScheme())) {
+                    if (ContentResolver.SCHEME_FILE.equals(uri.getScheme())) {
                         // We must not allow files from /data, even from our process.
                         final File f = new File(uri.getPath());
                         final String filePath = f.getCanonicalPath();
@@ -1932,7 +1941,16 @@
                                   "send_intent_attachment", "data_dir", 0);
                           continue;
                         }
+                    } else if (ContentResolver.SCHEME_CONTENT.equals(uri.getScheme())) {
+                        // disallow attachments from our own EmailProvider (b/27308057)
+                        if (getEmailProviderAuthority().equals(uri.getAuthority())) {
+                            showErrorToast(getString(R.string.attachment_permission_denied));
+                            Analytics.getInstance().sendEvent(ANALYTICS_CATEGORY_ERRORS,
+                                    "send_intent_attachment", "email_provider", 0);
+                            continue;
+                        }
                     }
+
                     if (!handleSpecialAttachmentUri(uri)) {
                         final Attachment a = mAttachmentsView.generateLocalAttachment(uri);
                         attachments.add(a);