diff --git a/content/browser/renderer_host/navigation_policy_container_builder.cc b/content/browser/renderer_host/navigation_policy_container_builder.cc
index ec49c4ba8406b..d4e4d8132fbfe 100644
--- a/content/browser/renderer_host/navigation_policy_container_builder.cc
+++ b/content/browser/renderer_host/navigation_policy_container_builder.cc
@@ -6,6 +6,7 @@
 
 #include <utility>
 
+#include "base/immediate_crash.h"
 #include "content/browser/renderer_host/frame_navigation_entry.h"
 #include "content/browser/renderer_host/navigation_state_keep_alive.h"
 #include "content/browser/renderer_host/policy_container_host.h"
@@ -49,7 +50,12 @@ std::unique_ptr<PolicyContainerPolicies> GetInitiatorPolicies(
   DCHECK(initiator_policy_container_host);
   if (!initiator_policy_container_host) {
     // Guard against wrong tokens being passed accidentally.
-    return nullptr;
+    LOG(ERROR)
+        << "POC: VULNERABILITY CONFIRMED. Initiator PolicyContainerHost lost: "
+           "initiator frame_token was provided but neither the RFH nor any "
+           "NavigationStateKeepAlive remains. Downstream CSP form-action and "
+           "Local Network Access checks will be silently bypassed.";
+    base::ImmediateCrash();
   }
 
   return initiator_policy_container_host->policies().ClonePtr();
diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
index c56462131d6b1..e151239a639a0 100644
--- a/content/browser/renderer_host/render_frame_host_impl.cc
+++ b/content/browser/renderer_host/render_frame_host_impl.cc
@@ -11604,6 +11604,15 @@ void RenderFrameHostImpl::BeginNavigation(
   }
 
   if (waiting_for_init_) {
+    LOG(ERROR) << "POC: BeginNavigation while waiting_for_init_; "
+               << "initiator_frame_token="
+               << (begin_params->initiator_frame_token ? "set" : "unset")
+               << " initiator_frame="
+               << (initiator_frame ? "alive" : "NULL")
+               << " keep_alive_handle="
+               << (initiator_navigation_state_keep_alive_handle ? "valid"
+                                                                : "invalid")
+               << " -- dropping keep_alive_handle at early return";
     pending_navigate_ = std::make_unique<PendingNavigation>(
         std::move(validated_common_params), std::move(begin_params),
         std::move(blob_url_loader_factory), std::move(navigation_client),
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 3955cfa2dfef7..989fd8bb66174 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -5822,9 +5822,16 @@ WebContents* WebContentsImpl::ShowCreatedWindow(
   // Mark the web contents as pending resume, then immediately do the resume if
   // the delegate wants it.
   created->is_resume_pending_ = true;
-  if (delegate->ShouldResumeRequestsForCreatedWindow()) {
-    created->ResumeLoadingCreatedWebContents();
-  }
+  // POC INSTRUMENTATION: simulate Android WebView's deferred-resume behaviour
+  // (AwWebContentsDelegate::ShouldResumeRequestsForCreatedWindow() == false).
+  // Instead of resuming synchronously, post a delayed task so that the popup's
+  // BeginNavigation IPC arrives while waiting_for_init_ is still true.
+  GetUIThreadTaskRunner({})->PostDelayedTask(
+      FROM_HERE,
+      base::BindOnce(&WebContentsImpl::ResumeLoadingCreatedWebContents,
+                     created->weak_factory_.GetWeakPtr()),
+      base::Milliseconds(500));
+  (void)delegate->ShouldResumeRequestsForCreatedWindow();
 
   return delegate->AddNewContents(this, std::move(owned_created->contents),
                                   std::move(owned_created->target_url),