diff --git a/content/browser/loader/navigation_url_loader_impl.cc b/content/browser/loader/navigation_url_loader_impl.cc
--- a/content/browser/loader/navigation_url_loader_impl.cc
+++ b/content/browser/loader/navigation_url_loader_impl.cc
@@ -1596,10 +1596,18 @@ void NavigationURLLoaderImpl::OnReceiveRedirect(
                         resource_request().is_outermost_main_frame);
   net::Error error = net::OK;

+  // For blob: navigations the URLLoaderClient remote is forwarded to whatever
+  // blink::mojom::Blob implementation is registered for the URL, which may be
+  // hosted in a (compromised) renderer. Do not trust the per-request
+  // bypass_redirect_checks bit on that path; blob loads are never expected to
+  // redirect anyway (see StartImpl()).
+  const bool head_bypass_is_trustworthy = !url_.SchemeIsBlob();
+
   bool bypass_redirect_checks =
-      base::FeatureList::IsEnabled(features::kBypassRedirectChecksPerRequest)
-          ? head->bypass_redirect_checks
-          : bypass_redirect_checks_;
+      (base::FeatureList::IsEnabled(features::kBypassRedirectChecksPerRequest) &&
+       head_bypass_is_trustworthy)
+          ? head->bypass_redirect_checks
+          : bypass_redirect_checks_;

   if (!bypass_redirect_checks &&
       !IsSafeRedirectTarget(url_, redirect_info.new_url)) {