diff --git a/chrome/browser/storage_access_api/storage_access_api_tab_helper.cc b/chrome/browser/storage_access_api/storage_access_api_tab_helper.cc
index d2fdedafca7b8..5fde25491bce8 100644
--- a/chrome/browser/storage_access_api/storage_access_api_tab_helper.cc
+++ b/chrome/browser/storage_access_api/storage_access_api_tab_helper.cc
@@ -10,6 +10,8 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/browser/web_contents_user_data.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
+#include "third_party/blink/public/common/storage_key/storage_key.h"
 
 #if BUILDFLAG(ENABLE_GUEST_VIEW)
 #include "components/guest_view/browser/guest_view_base.h"
@@ -38,6 +40,18 @@ void StorageAccessAPITabHelper::FrameReceivedUserActivation(
     return;
   }
 
+  // A nonce-partitioned, credentialless, fenced or sandboxed-without-SAA frame
+  // is isolated from the unpartitioned (embed, top) relationship and must not
+  // be able to renew the profile-wide STORAGE_ACCESS grant for it. This
+  // mirrors the gate in StorageAccessGrantPermissionContext::
+  // ValidatePermissionEligibility on the requestStorageAccess() path.
+  if (rfh->IsCredentialless() || rfh->IsNestedWithinFencedFrame() ||
+      rfh->IsSandboxed(
+          network::mojom::WebSandboxFlags::kStorageAccessByUserActivation) ||
+      rfh->GetStorageKey().ForbidsUnpartitionedStorageAccess()) {
+    return;
+  }
+
   service_->RenewPermissionGrant(
       rfh->GetLastCommittedOrigin(),
       rfh->GetParentOrOuterDocument()->GetLastCommittedOrigin());