diff --git a/components/autofill/content/renderer/form_autofill_util.cc b/components/autofill/content/renderer/form_autofill_util.cc
--- a/components/autofill/content/renderer/form_autofill_util.cc
+++ b/components/autofill/content/renderer/form_autofill_util.cc
@@ -2083,10 +2083,18 @@ FormFieldData* MaybeInitFormFieldData(
     }
   }

   if (auto* local_frame = element.GetDocument().GetFrame()) {
     if (auto* render_frame = content::RenderFrame::FromWebFrame(local_frame)) {
-      field->set_bounds(gfx::RectF(
-          render_frame->ConvertViewportToWindow(element.BoundsInWidget())));
+      // POC: simulate a compromised renderer sending arbitrary
+      // FormFieldData::bounds over autofill.mojom.AutofillDriver. No
+      // browser-side hop validates this rect before it reaches
+      // android.view.autofill.AutofillManager.notifyViewEntered(); the
+      // Android system FillUi will anchor to this screen position
+      // (after dip-scale + container-view translate), which can lie
+      // outside the WebView and over embedder native UI (e.g. the
+      // Omnibox in Chrome-on-Android 3P-autofill mode).
+      field->set_bounds(gfx::RectF(0, -150, 300, 40));
     }
   }

   field->set_value(element.Value().Utf16().substr(0, kMaxStringLength));