diff --git a/third_party/blink/renderer/modules/webgl/webgl2_rendering_context.cc b/third_party/blink/renderer/modules/webgl/webgl2_rendering_context.cc
index 69c18723e55ae..3b5f5a75f2f6d 100644
--- a/third_party/blink/renderer/modules/webgl/webgl2_rendering_context.cc
+++ b/third_party/blink/renderer/modules/webgl/webgl2_rendering_context.cc
@@ -120,7 +120,14 @@ void WebGL2RenderingContext::RegisterContextExtensions() {
   RegisterExtension<WebGLPolygonMode>();
   RegisterExtension<WebGLProvokingVertex>();
   RegisterExtension<WebGLRenderSharedExponent>();
-  RegisterExtension<WebGLShaderPixelLocalStorage>(kDraftExtension);
+  // POC: simulate compromised renderer — bypass the renderer-side
+  // WebGLDraftExtensions gate so that getExtension() issues
+  // RequestExtensionCHROMIUM("GL_ANGLE_shader_pixel_local_storage") to the GPU
+  // process. The GPU-side passthrough decoder whitelists this extension
+  // unconditionally (gles2_cmd_decoder_passthrough.cc kValidRequestableExtensions),
+  // so a compromised renderer reaches the vulnerable ANGLE translator path
+  // regardless of this Blink-side flag.
+  RegisterExtension<WebGLShaderPixelLocalStorage>();
   RegisterExtension<WebGLStencilTexturing>();
 }