Stop GuestViewBase from laundering guest-originated DraggableRegionsChanged
as if it came from the embedder WebContents. There is no generally-safe way
to forward guest-supplied regions to the embedder window: they are in
guest-relative coordinates, are not clipped to the guest viewport, and the
substituted source pointer defeats AppWindow's / AppBrowserController's
source-WebContents validation. Any embedder that legitimately wants
guest-driven draggable regions (currently only Glic) must add an explicit,
scoped, coordinate-transformed path rather than relying on this generic
launder.

diff --git a/components/guest_view/browser/guest_view_base.cc b/components/guest_view/browser/guest_view_base.cc
--- a/components/guest_view/browser/guest_view_base.cc
+++ b/components/guest_view/browser/guest_view_base.cc
@@ -1036,14 +1036,14 @@ bool GuestViewBase::CanDragEnter(content::WebContents* source,
 void GuestViewBase::DraggableRegionsChanged(
     const std::vector<blink::mojom::DraggableRegionPtr>& regions,
     content::WebContents* contents) {
   CHECK(!base::FeatureList::IsEnabled(features::kGuestViewMPArch));
-
-  if (!attached() || !embedder_web_contents()->GetDelegate()) {
-    return;
-  }
-
-  embedder_web_contents()->GetDelegate()->DraggableRegionsChanged(
-      regions, embedder_web_contents());
+  // Intentionally do not forward to the embedder delegate. Forwarding with
+  // `embedder_web_contents()` as the source launders guest-renderer-supplied
+  // regions past AppWindow::DraggableRegionsChanged's CHECK_EQ /
+  // AppBrowserController's active-tab guard, letting a compromised guest
+  // renderer set HTCAPTION over arbitrary embedder UI in embedder-relative
+  // coordinates. The browser never calls SetSupportsDraggableRegions(true) on
+  // generic <webview>/<controlledframe> guests, so a well-behaved guest
+  // renderer never sends this IPC anyway.
 }

 void GuestViewBase::OnZoomControllerDestroyed(zoom::ZoomController* source) {