--- a/content/app_shim_remote_cocoa/render_widget_host_ns_view_bridge.mm
+++ b/content/app_shim_remote_cocoa/render_widget_host_ns_view_bridge.mm
@@ -323,7 +323,12 @@ void RenderWidgetHostNSViewBridge::ShowSharingServicePicker(
     const std::vector<std::string>& file_paths,
     ShowSharingServicePickerCallback callback) {
   NSMutableArray* items = [[NSMutableArray alloc] init];
-  if (url.is_valid()) {
+  // SECURITY: Only convert http/https URLs to typed NSURLs. Converting a
+  // file:// URL via net::NSURLWithGURL produces an NSURL with isFileURL=YES,
+  // and NSSharingServicePicker treats it as a local file to attach/transmit.
+  // Legitimate file attachments arrive separately via |file_paths| (browser-
+  // generated temp files), never via |url|.
+  if (url.is_valid() && url.SchemeIsHTTPOrHTTPS()) {
     if (@available(macOS 13.0, *)) {
       NSString* ns_title =
           base::SysUTF8ToNSString(title.empty() ? url.spec() : title);