diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
index abe1dbb4ec313..e4b6c3d1a7c4f 100644
--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
@@ -28,6 +28,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/task/single_thread_task_runner.h"
 #include "base/threading/thread_restrictions.h"
+#include "base/threading/platform_thread.h"
 #include "base/time/time.h"
 #include "base/values.h"
 #include "build/build_config.h"
@@ -1581,6 +1582,16 @@ bool ChromeContentRendererClient::IsSafeRedirectTarget(
     const extensions::Extension* extension =
         extensions::RendererExtensionRegistry::Get()->GetExtensionOrAppByURL(
             target_url, /*include_guid=*/true);
+    // POC: widen the race window between lookup (above) and dereference
+    // (below). The lookup released the registry lock; the main thread can now
+    // run Dispatcher::UnloadExtension -> RendererExtensionRegistry::Remove and
+    // free `extension` while this worker thread sleeps.
+    LOG(ERROR) << "[POC] IsSafeRedirectTarget: got extension="
+               << static_cast<const void*>(extension) << " on thread '"
+               << base::PlatformThread::GetName() << "', sleeping...";
+    base::PlatformThread::Sleep(base::Milliseconds(1500));
+    LOG(ERROR) << "[POC] IsSafeRedirectTarget: woke, dereferencing extension="
+               << static_cast<const void*>(extension);
     if (!extension) {
       return false;
     }