diff --git a/chrome/browser/ui/views/permissions/permission_prompt_bubble.cc b/chrome/browser/ui/views/permissions/permission_prompt_bubble.cc
index f176aabd82ca4..a4e704e564574 100644
--- a/chrome/browser/ui/views/permissions/permission_prompt_bubble.cc
+++ b/chrome/browser/ui/views/permissions/permission_prompt_bubble.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/ui/views/permissions/permission_prompt_bubble.h"
 
 #include "base/functional/bind.h"
+#include "base/logging.h"
 #include "base/functional/callback_helpers.h"
 #include "chrome/browser/ui/browser_window/public/browser_window_features.h"
 #include "chrome/browser/ui/exclusive_access/exclusive_access_manager.h"
@@ -35,6 +36,7 @@ PermissionPromptBubble::PermissionPromptBubble(
 }
 
 PermissionPromptBubble::~PermissionPromptBubble() {
+  LOG(ERROR) << "POC-BUBBLE ~PermissionPromptBubble (bubble destroyed)";
   CleanUpPromptBubble();
   CHECK(!IsInObserverList());
 }
@@ -45,6 +47,11 @@ void PermissionPromptBubble::ShowBubble() {
                                                     .exclusive_access_manager()
                                                     ->fullscreen_controller();
   CHECK(fullscreen_controller);
+  LOG(ERROR) << "POC-BUBBLE ShowBubble IsTabFullscreen="
+             << fullscreen_controller->IsTabFullscreen()
+             << " (blocker will "
+             << (fullscreen_controller->IsTabFullscreen() ? "" : "NOT ")
+             << "be acquired)";
   if (fullscreen_controller->IsTabFullscreen()) {
     auto blocker =
         web_contents()->ForSecurityDropFullscreen(display::kInvalidDisplayId);
@@ -106,6 +113,18 @@ std::optional<gfx::Rect> PermissionPromptBubble::GetViewBoundsInScreen() const {
 
 bool PermissionPromptBubble::UpdateAnchor() {
   bool was_browser_changed = UpdateBrowser();
+  {
+    FullscreenController* fc = browser()
+                                   ->GetFeatures()
+                                   .exclusive_access_manager()
+                                   ->fullscreen_controller();
+    bool fs = fc && fc->IsTabFullscreen();
+    bool alive =
+        GetPromptBubble() && GetPromptBubble()->GetWidget() &&
+        GetPromptBubble()->GetWidget()->IsVisible();
+    LOG(ERROR) << "POC-BUBBLE UpdateAnchor fullscreen=" << fs
+               << " alive=" << alive;
+  }
   // TODO(crbug.com/40747230): Investigate why prompt_bubble_ can be null
   // here. Early return is preventing the crash from happening but we still
   // don't know the reason why it is null here and cannot reproduce it.
diff --git a/chrome/browser/ui/views/permissions/permission_prompt_factory.cc b/chrome/browser/ui/views/permissions/permission_prompt_factory.cc
index a614311803c0a..232251aa1fea3 100644
--- a/chrome/browser/ui/views/permissions/permission_prompt_factory.cc
+++ b/chrome/browser/ui/views/permissions/permission_prompt_factory.cc
@@ -24,6 +24,7 @@
 #include "chrome/common/webui_url_constants.h"
 #include "components/permissions/permission_request.h"
 #include "components/permissions/permission_uma_util.h"
+#include "base/logging.h"
 #include "components/permissions/permission_util.h"
 #include "components/permissions/permissions_client.h"
 #include "components/permissions/request_type.h"
@@ -255,6 +256,10 @@ std::unique_ptr<permissions::PermissionPrompt> CreateQuietPrompt(
 std::unique_ptr<permissions::PermissionPrompt> CreatePermissionPrompt(
     content::WebContents* web_contents,
     permissions::PermissionPrompt::Delegate* delegate) {
+  LOG(ERROR) << "POC-FACTORY CreatePermissionPrompt"
+             << " quiet=" << delegate->ShouldCurrentRequestUseQuietUI()
+             << " gesture="
+             << permissions::PermissionUtil::HasUserGesture(delegate);
   BrowserWindowInterface* browser_window_interface =
       GlobalBrowserCollection::GetInstance()->FindBrowserWithTab(web_contents);
   if (!browser_window_interface) {
diff --git a/components/permissions/permission_request_manager.cc b/components/permissions/permission_request_manager.cc
index 9516c6ee843eb..2866930ff0fc3 100644
--- a/components/permissions/permission_request_manager.cc
+++ b/components/permissions/permission_request_manager.cc
@@ -216,7 +216,12 @@ void PermissionRequestManager::AddRequest(
     return;
   }
 
-  if (display::Screen::Get()->IsHeadless()) {
+  // POC NOTE (environment workaround, NOT part of the vulnerability):
+  // This CI runner has no X server / Wayland compositor, so Chrome runs on
+  // --ozone-platform=headless and IsHeadless() is true. In production a real
+  // user has a real display and IsHeadless() is always false, so this gate
+  // never fires. It is unrelated to the fullscreen-blocker bug. See README.
+  if ((false) && display::Screen::Get()->IsHeadless()) {
     request->PermissionDenied();
     return;
   }
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index e5a78b6c5b320..7ed2695314ef2 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -4761,6 +4761,8 @@ bool WebContentsImpl::CanEnterFullscreenMode(
   // the screen, or that it was downstream from a WebContents when UI was
   // blocked. Therefore, disqualify it from fullscreen if it or any upstream
   // WebContents has an active blocker.
+  LOG(ERROR) << "POC-FULL CanEnterFullscreenMode fullscreen_blocker_count_="
+             << fullscreen_blocker_count_;
   return delegate_ &&
          std::ranges::all_of(GetAllOpeningWebContents(this),
                              [](auto opener) {
@@ -4773,6 +4775,7 @@ void WebContentsImpl::EnterFullscreenMode(
     RenderFrameHostImpl* requesting_frame,
     const blink::mojom::FullscreenOptions& options) {
   OPTIONAL_TRACE_EVENT0("content", "WebContentsImpl::EnterFullscreenMode");
+  LOG(ERROR) << "POC-FULL EnterFullscreenMode (tab going fullscreen)";
   DCHECK(CanEnterFullscreenMode(requesting_frame));
   DCHECK(requesting_frame->IsActive());
   CHECK(