diff --git a/extensions/common/api/_api_features.json b/extensions/common/api/_api_features.json
index 255c7be1c78b1..f2740cb256145 100644
--- a/extensions/common/api/_api_features.json
+++ b/extensions/common/api/_api_features.json
@@ -437,6 +437,13 @@
     "channel": "stable",
     "source": "metricsPrivate"
    },
+  // chrome-untrusted:// renderers are assumed-compromised. getHistogram()
+  // returns browser-wide UMA state collected from every child process, so it
+  // must not be exposed to webui_untrusted contexts. This child feature
+  // overrides the parent grant and restricts the function to the
+  // default_parent (privileged_extension) only.
+  "metricsPrivate.getHistogram": {
+  },
   "metricsPrivate.getIsCrashReportingEnabled": {
     "allowlist": [
       // This function inherits the extension restrictions of metricsPrivate,