diff --git a/ios/web/webui/crw_web_ui_scheme_handler.mm b/ios/web/webui/crw_web_ui_scheme_handler.mm
index 0000000..0000001 100644
--- a/ios/web/webui/crw_web_ui_scheme_handler.mm
+++ b/ios/web/webui/crw_web_ui_scheme_handler.mm
@@ -78,13 +78,18 @@
             } else if (filePath.Extension() == ".svg") {
               mimeType = @"image/svg+xml";
             }
+            // Bandaid: propagate the anti-framing / CSP headers that
+            // URLDataManagerIOSBackend declares for chrome:// responses,
+            // and stop emitting a wildcard Access-Control-Allow-Origin.
             NSHTTPURLResponse* response =
                 [[NSHTTPURLResponse alloc] initWithURL:urlSchemeTask.request.URL
                                             statusCode:200
                                            HTTPVersion:@"HTTP/1.1"
                                           headerFields:@{
                                             @"Content-Type" : mimeType,
-                                            @"Access-Control-Allow-Origin" : @"*"
+                                            @"X-Frame-Options" : @"DENY",
+                                            @"Content-Security-Policy" :
+                                                @"frame-ancestors 'none'"
                                           }];
             [urlSchemeTask didReceiveResponse:response];
             [urlSchemeTask didReceiveData:data];