diff --git a/frameworks/native/runtime/js_worker.cpp b/frameworks/native/runtime/js_worker.cpp
index 072a693bed..f8958b7c9e 100644
--- a/frameworks/native/runtime/js_worker.cpp
+++ b/frameworks/native/runtime/js_worker.cpp
@@ -54,6 +54,7 @@ constexpr int32_t API8 = 8;
 constexpr int32_t API12 = 12;
 const std::string BUNDLE_NAME_FLAG = "@bundle:";
 const std::string CACHE_DIRECTORY = "el2";
+const std::string RESTRICTED_PREFIX_PATH = "abcs/";
 const int PATH_THREE = 3;
 #ifdef APP_USE_ARM
 constexpr char ARK_DEBUGGER_LIB_PATH[] = "/system/lib/platformsdk/libark_debugger.z.so";
@@ -246,6 +247,10 @@ void AssetHelper::operator()(const std::string& uri, uint8_t** buff, size_t* buf
         }
 
         filePath = NormalizedFileName(realPath);
+        // for safe reason, filePath must starts with 'abcs/' in restricted env
+        if (isRestricted && filePath.find(RESTRICTED_PREFIX_PATH) && workerInfo_->apiTargetVersion >= API12) {
+            filePath = RESTRICTED_PREFIX_PATH + filePath;
+        }
         ami = workerInfo_->codePath + filePath;
         TAG_LOGD(AAFwkTag::JSRUNTIME, "Get asset, ami: %{private}s", ami.c_str());
         if (ami.find(CACHE_DIRECTORY) != std::string::npos) {