diff --git a/chromecast/cast_core/runtime/browser/cast_runtime_content_browser_client.cc b/chromecast/cast_core/runtime/browser/cast_runtime_content_browser_client.cc
index d0808b131853f..8c9447874de76 100644
--- a/chromecast/cast_core/runtime/browser/cast_runtime_content_browser_client.cc
+++ b/chromecast/cast_core/runtime/browser/cast_runtime_content_browser_client.cc
@@ -36,9 +36,11 @@ class CoreCastService : public shell::CastServiceSimple {
 
   // CastServiceSimple overrides:
   void StartInternal() override {
-    if (!runtime_service_->Start().ok()) {
-      base::Process::TerminateCurrentProcessImmediately(1);
-    }
+    // POC: bypass Cast Core gRPC orchestration and load the URL passed on
+    // the command line (this is what the production Cast Core service would
+    // ultimately instruct the runtime to do; we shortcut that here so the
+    // renderer can be reached without a Cast Core test harness).
+    shell::CastServiceSimple::StartInternal();
   }
 
   void StopInternal() override { runtime_service_->Stop(); }
diff --git a/components/cast_receiver/renderer/content_renderer_client_mixins_impl.cc b/components/cast_receiver/renderer/content_renderer_client_mixins_impl.cc
index 3ca9c4a106fc1..19f055ea709fc 100644
--- a/components/cast_receiver/renderer/content_renderer_client_mixins_impl.cc
+++ b/components/cast_receiver/renderer/content_renderer_client_mixins_impl.cc
@@ -4,6 +4,7 @@
 
 #include "components/cast_receiver/renderer/content_renderer_client_mixins_impl.h"
 
+#include "base/threading/platform_thread.h"
 #include "components/cast_receiver/renderer/url_rewrite_rules_provider.h"
 #include "components/media_control/renderer/media_playback_options.h"
 #include "components/on_load_script_injector/renderer/on_load_script_injector.h"
@@ -91,6 +92,12 @@ UrlRewriteRulesProvider*
 ContentRendererClientMixinsImpl::GetUrlRewriteRulesProvider(
     const blink::LocalFrameToken& frame_token) {
   auto rules_it = url_rewrite_rules_providers_.find(frame_token);
+  // POC race-window widening: simulate thread preemption between obtaining
+  // the flat_map iterator and dereferencing it. The unsynchronized main-thread
+  // emplace()/erase() may reallocate or shift the backing std::vector during
+  // this window, leaving |rules_it| pointing into freed storage. This sleep
+  // does not change the bug — it only enlarges a window that already exists.
+  base::PlatformThread::Sleep(base::Milliseconds(10));
   return rules_it == url_rewrite_rules_providers_.end()
              ? nullptr
              : rules_it->second.get();
diff --git a/components/crash/content/browser/crash_handler_host_linux.cc b/components/crash/content/browser/crash_handler_host_linux.cc
index 21bff545c754f..8fea1896d0346 100644
--- a/components/crash/content/browser/crash_handler_host_linux.cc
+++ b/components/crash/content/browser/crash_handler_host_linux.cc
@@ -384,8 +384,8 @@ void CrashHandlerHostLinux::FindCrashingThreadAndDump(
   info->crash_keys = crash_keys.release();
 #if defined(ADDRESS_SANITIZER)
   asan_report[kMaxAsanReportSize] = '\0';
-  info->asan_report_str = asan_report.release();
-  info->asan_report_length = strlen(info->asan_report_str);
+  info->asan_report_str = std::move(asan_report).leak().data();
+  info->asan_report_length = UNSAFE_TODO(strlen(info->asan_report_str));
 #endif
 
   info->process_start_time = uptime;
@@ -456,8 +456,10 @@ void CrashHandlerHostLinux::WriteDumpFile(BreakpadInfo* info,
   // Freed in CrashDumpTask().
   char* minidump_log_filename_str = new char[minidump_filename.length() + 1];
   minidump_filename.copy(minidump_log_filename_str, minidump_filename.length());
-  memcpy(minidump_log_filename_str + minidump_filename.length() - 3, "log", 3);
-  minidump_log_filename_str[minidump_filename.length()] = '\0';
+  UNSAFE_TODO(
+      memcpy(minidump_log_filename_str + minidump_filename.length() - 3, "log",
+             3));
+  UNSAFE_TODO(minidump_log_filename_str[minidump_filename.length()]) = '\0';
   info->log_filename = minidump_log_filename_str;
 #endif
   info->pid = crashing_pid;
diff --git a/components/crash/core/app/breakpad_linux.cc b/components/crash/core/app/breakpad_linux.cc
index adc0fb959ac1a..e6f31ca66a46a 100644
--- a/components/crash/core/app/breakpad_linux.cc
+++ b/components/crash/core/app/breakpad_linux.cc
@@ -404,9 +404,9 @@ bool CrashDone(const MinidumpDescriptor& minidump,
   google_breakpad::PageAllocator allocator;
   const size_t log_path_len = my_strlen(minidump.path());
   char* log_path = reinterpret_cast<char*>(allocator.Alloc(log_path_len + 1));
-  my_memcpy(log_path, minidump.path(), log_path_len);
-  my_memcpy(log_path + log_path_len - 4, ".log", 4);
-  log_path[log_path_len] = '\0';
+  UNSAFE_TODO(my_memcpy(log_path, minidump.path(), log_path_len));
+  UNSAFE_TODO(my_memcpy(log_path + log_path_len - 4, ".log", 4));
+  UNSAFE_TODO(log_path[log_path_len]) = '\0';
   info.log_filename = log_path;
 #endif
   info.process_type = "browser";