diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 1251edd2da15c..1f45bba27a73f 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -40,6 +40,7 @@
 #include "base/no_destructor.h"
 #include "base/observer_list.h"
 #include "base/process/process.h"
+#include "base/run_loop.h"
 #include "base/strings/strcat.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
@@ -4852,6 +4853,18 @@ void WebContentsImpl::ExitFullscreenMode(bool will_cause_resize) {
     // See crbug.com/1506535, crbug.com/498752242.
     base::WeakPtr<WebContents> weak_ptr = GetWeakPtr();
     delegate_->ExitFullscreenModeForTab(this);
+    {
+      // POC: Linux simulation of the nested message loop that the macOS
+      // implementation of ExitFullscreenModeForTab pumps during the NSWindow
+      // fullscreen transition (the behavior the comment above documents).
+      // This is *not* a security bypass: callers are already required by
+      // contract to tolerate re-entrancy here. It exists only so the UAF in
+      // ShowFilePickerOnUIThread can be demonstrated on a Linux test host.
+      base::RunLoop nested(base::RunLoop::Type::kNestableTasksAllowed);
+      base::SingleThreadTaskRunner::GetCurrentDefault()->PostDelayedTask(
+          FROM_HERE, nested.QuitClosure(), base::Milliseconds(1500));
+      nested.Run();
+    }
     if (!weak_ptr) {
       return;
     }