diff --git a/content/browser/hid/hid_service.cc b/content/browser/hid/hid_service.cc
index 9b5e15f..fe153f8 100644
--- a/content/browser/hid/hid_service.cc
+++ b/content/browser/hid/hid_service.cc
@@ -25,6 +25,7 @@
 #include "mojo/public/cpp/bindings/message.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "services/device/public/cpp/device_features.h"
+#include "services/device/public/cpp/hid/hid_report_utils.h"
 #include "services/network/public/mojom/permissions_policy/permissions_policy_feature.mojom.h"
 
 namespace content {
@@ -206,6 +207,100 @@
       std::move(receiver));
 }
 
+namespace {
+
+// Recursively filters reports from the collection tree. Returns true if the
+// collection is now empty (has no reports and no active children) and should
+// be pruned by its parent.
+bool FilterCollectionReports(
+    device::mojom::HidCollectionInfo& collection,
+    const device::mojom::HidCollectionInfo& original_collection,
+    const std::optional<std::vector<uint8_t>>& protected_input_report_ids,
+    const std::optional<std::vector<uint8_t>>& protected_output_report_ids,
+    const std::optional<std::vector<uint8_t>>& protected_feature_report_ids,
+    bool is_fido_allowed) {
+  // Recursively filter children first.
+  std::vector<device::mojom::HidCollectionInfoPtr> children;
+  CHECK_EQ(collection.children.size(), original_collection.children.size());
+  for (size_t i = 0; i < collection.children.size(); ++i) {
+    if (!FilterCollectionReports(
+            *collection.children[i], *original_collection.children[i],
+            protected_input_report_ids, protected_output_report_ids,
+            protected_feature_report_ids, is_fido_allowed)) {
+      children.push_back(std::move(collection.children[i]));
+    }
+  }
+  collection.children = std::move(children);
+
+  // Filter input reports.
+  std::vector<device::mojom::HidReportDescriptionPtr> input_reports;
+  for (auto& report : collection.input_reports) {
+    const bool is_fido = device::HasReportInCollectionWithUsagePage(
+        original_collection, report->report_id, device::HidReportType::kInput,
+        device::mojom::kPageFido);
+    const bool is_always_protected =
+        device::HasReportInAlwaysProtectedCollection(
+            original_collection, report->report_id,
+            device::HidReportType::kInput);
+    if ((is_fido && is_fido_allowed) ||
+        (!is_always_protected &&
+         (!protected_input_report_ids.has_value() ||
+          !std::ranges::contains(*protected_input_report_ids,
+                                 report->report_id)))) {
+      input_reports.push_back(std::move(report));
+    }
+  }
+  collection.input_reports = std::move(input_reports);
+
+  // Filter output reports.
+  std::vector<device::mojom::HidReportDescriptionPtr> output_reports;
+  for (auto& report : collection.output_reports) {
+    const bool is_fido = device::HasReportInCollectionWithUsagePage(
+        original_collection, report->report_id, device::HidReportType::kOutput,
+        device::mojom::kPageFido);
+    const bool is_always_protected =
+        device::HasReportInAlwaysProtectedCollection(
+            original_collection, report->report_id,
+            device::HidReportType::kOutput);
+    if ((is_fido && is_fido_allowed) ||
+        (!is_always_protected &&
+         (!protected_output_report_ids.has_value() ||
+          !std::ranges::contains(*protected_output_report_ids,
+                                 report->report_id)))) {
+      output_reports.push_back(std::move(report));
+    }
+  }
+  collection.output_reports = std::move(output_reports);
+
+  // Filter feature reports.
+  std::vector<device::mojom::HidReportDescriptionPtr> feature_reports;
+  for (auto& report : collection.feature_reports) {
+    const bool is_fido = device::HasReportInCollectionWithUsagePage(
+        original_collection, report->report_id, device::HidReportType::kFeature,
+        device::mojom::kPageFido);
+    const bool is_always_protected =
+        device::HasReportInAlwaysProtectedCollection(
+            original_collection, report->report_id,
+            device::HidReportType::kFeature);
+    if ((is_fido && is_fido_allowed) ||
+        (!is_always_protected &&
+         (!protected_feature_report_ids.has_value() ||
+          !std::ranges::contains(*protected_feature_report_ids,
+                                 report->report_id)))) {
+      feature_reports.push_back(std::move(report));
+    }
+  }
+  collection.feature_reports = std::move(feature_reports);
+
+  // Return true if this collection is now empty and should be pruned by its
+  // parent.
+  return collection.input_reports.empty() &&
+         collection.output_reports.empty() &&
+         collection.feature_reports.empty() && collection.children.empty();
+}
+
+}  // namespace
+
 // static
 void HidService::RemoveProtectedReports(device::mojom::HidDeviceInfo& device,
                                         bool is_known_security_key,
@@ -219,44 +314,60 @@
     return;
   }
 #endif  // !BUILDFLAG(IS_ANDROID)
+
   std::vector<device::mojom::HidCollectionInfoPtr> collections;
-  for (auto& collection : device.collections) {
-    const bool is_fido =
-        collection->usage->usage_page == device::mojom::kPageFido;
-    std::vector<device::mojom::HidReportDescriptionPtr> input_reports;
-    for (auto& report : collection->input_reports) {
-      if ((is_fido && is_fido_allowed) ||
-          !device.protected_input_report_ids.has_value() ||
-          !std::ranges::contains(*device.protected_input_report_ids,
-                                 report->report_id)) {
-        input_reports.push_back(std::move(report));
+  if (base::FeatureList::IsEnabled(features::kWebHidRecursiveFiltering)) {
+    // Clone to preserve original state for queries.
+    auto original_device = device.Clone();
+    for (size_t i = 0; i < device.collections.size(); ++i) {
+      if (!FilterCollectionReports(
+              *device.collections[i], *original_device->collections[i],
+              original_device->protected_input_report_ids,
+              original_device->protected_output_report_ids,
+              original_device->protected_feature_report_ids, is_fido_allowed)) {
+        collections.push_back(std::move(device.collections[i]));
       }
     }
-    std::vector<device::mojom::HidReportDescriptionPtr> output_reports;
-    for (auto& report : collection->output_reports) {
-      if ((is_fido && is_fido_allowed) ||
-          !device.protected_output_report_ids.has_value() ||
-          !std::ranges::contains(*device.protected_output_report_ids,
-                                 report->report_id)) {
-        output_reports.push_back(std::move(report));
+  } else {
+    // Fall back to old flat filtering.
+    for (auto& collection : device.collections) {
+      const bool is_fido =
+          collection->usage->usage_page == device::mojom::kPageFido;
+      std::vector<device::mojom::HidReportDescriptionPtr> input_reports;
+      for (auto& report : collection->input_reports) {
+        if ((is_fido && is_fido_allowed) ||
+            !device.protected_input_report_ids.has_value() ||
+            !std::ranges::contains(*device.protected_input_report_ids,
+                                   report->report_id)) {
+          input_reports.push_back(std::move(report));
+        }
       }
-    }
-    std::vector<device::mojom::HidReportDescriptionPtr> feature_reports;
-    for (auto& report : collection->feature_reports) {
-      if ((is_fido && is_fido_allowed) ||
-          !device.protected_feature_report_ids.has_value() ||
-          !std::ranges::contains(*device.protected_feature_report_ids,
-                                 report->report_id)) {
-        feature_reports.push_back(std::move(report));
+      std::vector<device::mojom::HidReportDescriptionPtr> output_reports;
+      for (auto& report : collection->output_reports) {
+        if ((is_fido && is_fido_allowed) ||
+            !device.protected_output_report_ids.has_value() ||
+            !std::ranges::contains(*device.protected_output_report_ids,
+                                   report->report_id)) {
+          output_reports.push_back(std::move(report));
+        }
       }
-    }
-    // Only keep the collection if it has at least one report.
-    if (!input_reports.empty() || !output_reports.empty() ||
-        !feature_reports.empty()) {
-      collection->input_reports = std::move(input_reports);
-      collection->output_reports = std::move(output_reports);
-      collection->feature_reports = std::move(feature_reports);
-      collections.push_back(std::move(collection));
+      std::vector<device::mojom::HidReportDescriptionPtr> feature_reports;
+      for (auto& report : collection->feature_reports) {
+        if ((is_fido && is_fido_allowed) ||
+            !device.protected_feature_report_ids.has_value() ||
+            !std::ranges::contains(*device.protected_feature_report_ids,
+                                   report->report_id)) {
+          feature_reports.push_back(std::move(report));
+        }
+      }
+      // Only keep the collection if it has at least one report.
+      if (!input_reports.empty() || !output_reports.empty() ||
+          !feature_reports.empty()) {
+        collection->input_reports = std::move(input_reports);
+        collection->output_reports = std::move(output_reports);
+        collection->feature_reports = std::move(feature_reports);
+        collections.push_back(std::move(collection));
+      }
     }
   }
   device.collections = std::move(collections);
@@ -577,7 +688,25 @@
 void HidService::FinishRequestDevice(
     RequestDeviceCallback callback,
     std::vector<device::mojom::HidDeviceInfoPtr> devices) {
-  std::move(callback).Run(std::move(devices));
+  auto* browser_context = GetBrowserContext();
+  auto* delegate = GetContentClient()->browser()->GetHidDelegate();
+  if (!browser_context || !delegate) {
+    std::move(callback).Run(std::vector<device::mojom::HidDeviceInfoPtr>());
+    return;
+  }
+
+  bool is_fido_allowed =
+      delegate->IsFidoAllowedForOrigin(browser_context, origin_);
+  std::vector<device::mojom::HidDeviceInfoPtr> result;
+  for (auto& device : devices) {
+    RemoveProtectedReports(
+        *device, delegate->IsKnownSecurityKey(browser_context, *device),
+        is_fido_allowed);
+    if (!device->collections.empty()) {
+      result.push_back(std::move(device));
+    }
+  }
+  std::move(callback).Run(std::move(result));
 }
 
 void HidService::FinishConnect(
diff --git a/services/device/hid/hid_connection.cc b/services/device/hid/hid_connection.cc
index 6a8afc9..7fa17b8f 100644
--- a/services/device/hid/hid_connection.cc
+++ b/services/device/hid/hid_connection.cc
@@ -8,6 +8,7 @@
 
 #include "base/memory/ref_counted_memory.h"
 #include "components/device_event_log/device_event_log.h"
+#include "services/device/public/cpp/device_features.h"
 #include "services/device/public/cpp/hid/hid_blocklist.h"
 #include "services/device/public/cpp/hid/hid_report_type.h"
 #include "services/device/public/cpp/hid/hid_report_utils.h"
@@ -169,9 +170,15 @@
       }
       auto* collection_info =
           FindCollectionWithReport(device, report_id, report_type);
-      if (collection_info &&
-          collection_info->usage->usage_page == mojom::kPageFido) {
-        return false;
+      if (collection_info) {
+        if (base::FeatureList::IsEnabled(features::kWebHidRecursiveFiltering)) {
+          if (HasReportInCollectionWithUsagePage(
+                  *collection_info, report_id, report_type, mojom::kPageFido)) {
+            return false;
+          }
+        } else if (collection_info->usage->usage_page == mojom::kPageFido) {
+          return false;
+        }
       }
     }
 
@@ -202,7 +209,12 @@
   auto* collection_info =
       FindCollectionWithReport(device, report_id, report_type);
   if (collection_info) {
-    return IsAlwaysProtected(*collection_info->usage, report_type);
+    if (base::FeatureList::IsEnabled(features::kWebHidRecursiveFiltering)) {
+      return HasReportInAlwaysProtectedCollection(*collection_info, report_id,
+                                                  report_type);
+    } else {
+      return IsAlwaysProtected(*collection_info->usage, report_type);
+    }
   }
 
   return HasAlwaysProtectedCollectionFor(report_type);
diff --git a/services/device/public/cpp/device_features.cc b/services/device/public/cpp/device_features.cc
index 938c6dd..8ab64b7 100644
--- a/services/device/public/cpp/device_features.cc
+++ b/services/device/public/cpp/device_features.cc
@@ -127,6 +127,10 @@
              base::FEATURE_ENABLED_BY_DEFAULT);
 #endif  // !BUILDFLAG(IS_ANDROID)
 
+// Enables recursive filtering of nested HID collections to prevent WebHID
+// security bypasses (e.g., nested keyboards or FIDO keys).
+BASE_FEATURE(kWebHidRecursiveFiltering, base::FEATURE_ENABLED_BY_DEFAULT);
+
 const base::FeatureParam<device::mojom::LocationProviderManagerMode>::Option
     location_provider_manager_mode_options[] = {
         {device::mojom::LocationProviderManagerMode::kNetworkOnly,
diff --git a/services/device/public/cpp/device_features.h b/services/device/public/cpp/device_features.h
index ff95d09..96e36de7 100644
--- a/services/device/public/cpp/device_features.h
+++ b/services/device/public/cpp/device_features.h
@@ -57,6 +57,8 @@
 DEVICE_FEATURES_EXPORT BASE_DECLARE_FEATURE(kSecurityKeyHidInterfacesAreFido);
 #endif  // !BUILDFLAG(IS_ANDROID)
 
+DEVICE_FEATURES_EXPORT BASE_DECLARE_FEATURE(kWebHidRecursiveFiltering);
+
 extern const DEVICE_FEATURES_EXPORT
     base::FeatureParam<device::mojom::LocationProviderManagerMode>
         kLocationProviderManagerParam;
diff --git a/services/device/public/cpp/hid/hid_blocklist.cc b/services/device/public/cpp/hid/hid_blocklist.cc
index d95caeae..83c3d293 100644
--- a/services/device/public/cpp/hid/hid_blocklist.cc
+++ b/services/device/public/cpp/hid/hid_blocklist.cc
@@ -140,6 +140,20 @@
   }
 }
 
+bool MatchesUsage(const HidBlocklist::Entry& entry,
+                  const mojom::HidCollectionInfo& collection) {
+  if (!entry.has_usage_page) {
+    return true;
+  }
+  if (entry.usage_page != collection.usage->usage_page) {
+    return false;
+  }
+  if (!entry.has_usage) {
+    return true;
+  }
+  return entry.usage == collection.usage->usage;
+}
+
 // Iterates over |collections| to find reports of type |report_type| that should
 // be protected according to the blocklist rule |entry|. |vendor_id| and
 // |product_id| are the vendor and product IDs of the device with these reports.
@@ -166,18 +180,21 @@
   }
 
   for (const auto& collection : collections) {
-    if (entry.has_usage_page) {
-      if (entry.usage_page != collection->usage->usage_page)
-        continue;
-
-      if (entry.has_usage && entry.usage != collection->usage->usage)
-        continue;
+    if (MatchesUsage(entry, *collection)) {
+      const auto& reports = GetReportsForType(report_type, *collection);
+      for (const auto& report : reports) {
+        if (!entry.has_report_id || entry.report_id == report->report_id) {
+          protected_ids.insert(report->report_id);
+        }
+      }
     }
-
-    const auto& reports = GetReportsForType(report_type, *collection);
-    for (const auto& report : reports) {
-      if (!entry.has_report_id || entry.report_id == report->report_id)
-        protected_ids.insert(report->report_id);
+    // A report defined in a child collection is also part of the enclosing
+    // top-level collection. Evaluate usage-based rules against child
+    // collections as well so reports defined in protected child collections
+    // are not missed.
+    if (base::FeatureList::IsEnabled(features::kWebHidRecursiveFiltering)) {
+      CheckBlocklistEntry(entry, report_type, vendor_id, product_id,
+                          collection->children, protected_ids);
     }
   }
 }
diff --git a/services/device/public/cpp/hid/hid_report_utils.cc b/services/device/public/cpp/hid/hid_report_utils.cc
index fcb588a..b153a35 100644
--- a/services/device/public/cpp/hid/hid_report_utils.cc
+++ b/services/device/public/cpp/hid/hid_report_utils.cc
@@ -23,6 +23,14 @@
   }
 }
 
+bool CollectionContainsReport(const mojom::HidCollectionInfo& collection,
+                              uint8_t report_id,
+                              HidReportType report_type) {
+  return std::ranges::contains(ReportsForType(collection, report_type),
+                               report_id,
+                               &mojom::HidReportDescription::report_id);
+}
+
 }  // namespace
 
 bool IsAlwaysProtected(const mojom::HidUsageAndPage& hid_usage_and_page,
@@ -113,4 +121,41 @@
   return find_it->get();
 }
 
+bool HasReportInAlwaysProtectedCollection(
+    const mojom::HidCollectionInfo& collection,
+    uint8_t report_id,
+    HidReportType report_type) {
+  if (!CollectionContainsReport(collection, report_id, report_type)) {
+    return false;
+  }
+  if (collection.collection_type == mojom::kHIDCollectionTypeApplication &&
+      IsAlwaysProtected(*collection.usage, report_type)) {
+    return true;
+  }
+  return std::ranges::any_of(collection.children, [report_id, report_type](
... (file diff truncated)

diff --git a/content/browser/hid/hid_service_unittest.cc b/content/browser/hid/hid_service_unittest.cc
index a3bcd5b..8c2ba32 100644
--- a/content/browser/hid/hid_service_unittest.cc
+++ b/content/browser/hid/hid_service_unittest.cc
@@ -200,6 +200,18 @@
         device::TestReportDescriptors::FidoU2fHid());
   }
 
+  device::mojom::HidDeviceInfoPtr CreateNestedFidoDevice() {
+    return device::CreateDeviceFromReportDescriptor(
+        /*vendor_id=*/0x1234, /*product_id=*/0xabcd,
+        device::TestReportDescriptors::VendorWithNestedFido());
+  }
+
+  device::mojom::HidDeviceInfoPtr CreateNestedKeyboardDevice() {
+    return device::CreateDeviceFromReportDescriptor(
+        /*vendor_id=*/0x1234, /*product_id=*/0xabcd,
+        device::TestReportDescriptors::VendorWithNestedKeyboard());
+  }
+
   device::mojom::HidDeviceInfoPtr CreateTitanFidoDevice() {
     return device::CreateDeviceFromReportDescriptor(
         kVendorGoogle, kProductTitan,
@@ -353,7 +365,8 @@
  public:
   void SetUp() override {
     scoped_feature_list_.InitWithFeatures(
-        /*enabled_features=*/{features::kSecurityKeyHidInterfacesAreFido},
+        /*enabled_features=*/{features::kSecurityKeyHidInterfacesAreFido,
+                              features::kWebHidRecursiveFiltering},
         /*disabled_features=*/{});
   }
 
@@ -1376,6 +1389,147 @@
   }
 }
 
+TEST_P(HidServiceFidoTest, NestedFidoDeviceAllowedWithPrivilegedOrigin) {
+  auto service_creation_type = std::get<0>(GetParam());
+  const auto& service = GetService(service_creation_type);
+  const bool is_fido_allowed = std::get<1>(GetParam());
+
+  url::Origin origin = url::Origin::Create(GURL(kTestUrl));
+  EXPECT_CALL(hid_delegate(), IsFidoAllowedForOrigin(_, origin))
+      .WillRepeatedly(Return(is_fido_allowed));
+  EXPECT_CALL(hid_delegate(), HasDevicePermission).WillRepeatedly(Return(true));
+
+  TestFuture<std::vector<device::mojom::HidDeviceInfoPtr>> get_devices_future;
+  service->GetDevices(get_devices_future.GetCallback());
+  EXPECT_TRUE(get_devices_future.Get().empty());
+
+  auto device_info = CreateNestedFidoDevice();
+  ASSERT_EQ(device_info->collections.size(), 1u);
+  EXPECT_EQ(device_info->collections[0]->usage->usage_page,
+            device::mojom::kPageVendor);
+  ASSERT_EQ(device_info->collections[0]->children.size(), 1u);
+  EXPECT_EQ(device_info->collections[0]->children[0]->usage->usage_page,
+            device::mojom::kPageFido);
+
+  TestFuture<device::mojom::HidDeviceInfoPtr> device_added_future;
+  if (is_fido_allowed) {
+    EXPECT_CALL(hid_manager_client(), DeviceAdded)
+        .WillOnce(InvokeFuture(device_added_future));
+  } else {
+    EXPECT_CALL(hid_manager_client(), DeviceAdded).Times(0);
+  }
+  ConnectDevice(*device_info);
+  if (is_fido_allowed) {
+    const auto& d = *device_added_future.Get();
+    ASSERT_EQ(d.collections.size(), 1u);
+    ASSERT_EQ(d.collections[0]->children.size(), 1u);
+    EXPECT_EQ(d.collections[0]->children[0]->input_reports.size(), 1u);
+    EXPECT_EQ(d.collections[0]->children[0]->output_reports.size(), 1u);
+  } else {
+    FlushHidServicePipe(service_);
+  }
+
+  TestFuture<device::mojom::HidDeviceInfoPtr> device_changed_future;
+  EXPECT_CALL(hid_manager_client(), DeviceChanged)
+      .WillOnce(InvokeFuture(device_changed_future));
+
+  auto joystick = device::mojom::HidCollectionInfo::New();
+  joystick->usage = device::mojom::HidUsageAndPage::New(
+      device::mojom::kGenericDesktopJoystick,
+      device::mojom::kPageGenericDesktop);
+  joystick->collection_type = device::mojom::kHIDCollectionTypeApplication;
+  joystick->feature_reports.push_back(
+      device::mojom::HidReportDescription::New());
+
+  auto updated_device_info = device_info.Clone();
+  updated_device_info->collections.push_back(std::move(joystick));
+  UpdateDevice(*updated_device_info);
+  const auto& changed_d = *device_changed_future.Get();
+  if (is_fido_allowed) {
+    ASSERT_EQ(changed_d.collections.size(), 2u);
+    EXPECT_EQ(changed_d.collections[0]->usage->usage_page,
+              device::mojom::kPageVendor);
+    ASSERT_EQ(changed_d.collections[0]->children.size(), 1u);
+    EXPECT_EQ(changed_d.collections[1]->usage->usage_page,
+              device::mojom::kPageGenericDesktop);
+    EXPECT_EQ(changed_d.collections[1]->usage->usage,
+              device::mojom::kGenericDesktopJoystick);
+  } else {
+    ASSERT_EQ(changed_d.collections.size(), 1u);
+    EXPECT_EQ(changed_d.collections[0]->usage->usage_page,
+              device::mojom::kPageGenericDesktop);
+    EXPECT_EQ(changed_d.collections[0]->usage->usage,
+              device::mojom::kGenericDesktopJoystick);
+  }
+
+  TestFuture<device::mojom::HidDeviceInfoPtr> device_removed_future;
+  EXPECT_CALL(hid_manager_client(), DeviceRemoved)
+      .WillOnce(InvokeFuture(device_removed_future));
+  DisconnectDevice(*updated_device_info);
+  const auto& removed_d = *device_removed_future.Get();
+  if (is_fido_allowed) {
+    EXPECT_EQ(removed_d.collections.size(), 2u);
+  } else {
+    EXPECT_EQ(removed_d.collections.size(), 1u);
+  }
+}
+
+TEST_P(HidServiceTest, NestedKeyboardDeviceBlocked) {
+  base::test::ScopedFeatureList feature_list;
+  feature_list.InitAndEnableFeature(features::kWebHidRecursiveFiltering);
+
+  auto service_creation_type = GetParam();
+  GetService(service_creation_type);
+
+  // Set up global expectations for the delegate.
+  EXPECT_CALL(hid_delegate(), HasDevicePermission).WillRepeatedly(Return(true));
+
+  auto device_info = CreateNestedKeyboardDevice();
+  ASSERT_EQ(device_info->collections.size(), 1u);
+  EXPECT_EQ(device_info->collections[0]->usage->usage_page,
+            device::mojom::kPageVendor);
+  ASSERT_EQ(device_info->collections[0]->children.size(), 1u);
+  EXPECT_EQ(device_info->collections[0]->children[0]->usage->usage_page,
+            device::mojom::kPageGenericDesktop);
+  EXPECT_EQ(device_info->collections[0]->children[0]->usage->usage,
+            device::mojom::kGenericDesktopKeyboard);
+
+  EXPECT_CALL(hid_manager_client(), DeviceAdded).Times(0);
+  ConnectDevice(*device_info);
+  FlushHidServicePipe(service_);
+
+  base::RunLoop device_changed_loop;
+  EXPECT_CALL(hid_manager_client(), DeviceChanged).WillOnce([&](auto d) {
+    EXPECT_EQ(d->collections.size(), 1u);
+    EXPECT_EQ(d->collections[0]->usage->usage_page,
+              device::mojom::kPageGenericDesktop);
+    EXPECT_EQ(d->collections[0]->usage->usage,
+              device::mojom::kGenericDesktopJoystick);
+    device_changed_loop.Quit();
+  });
+
+  auto joystick = device::mojom::HidCollectionInfo::New();
+  joystick->usage = device::mojom::HidUsageAndPage::New(
+      device::mojom::kGenericDesktopJoystick,
+      device::mojom::kPageGenericDesktop);
+  joystick->collection_type = device::mojom::kHIDCollectionTypeApplication;
+  joystick->feature_reports.push_back(
+      device::mojom::HidReportDescription::New());
+
+  auto updated_device_info = device_info.Clone();
+  updated_device_info->collections.push_back(std::move(joystick));
+  UpdateDevice(*updated_device_info);
+  device_changed_loop.Run();
+
+  base::RunLoop device_removed_loop;
+  EXPECT_CALL(hid_manager_client(), DeviceRemoved).WillOnce([&](auto d) {
+    EXPECT_EQ(d->collections.size(), 1u);
+    device_removed_loop.Quit();
+  });
+  DisconnectDevice(*updated_device_info);
+  device_removed_loop.Run();
+}
+
 INSTANTIATE_TEST_SUITE_P(
     HidServiceTests,
     HidServiceTest,
diff --git a/services/device/hid/hid_connection_unittest.cc b/services/device/hid/hid_connection_unittest.cc
index 614ee02..f1ebd3d 100644
--- a/services/device/hid/hid_connection_unittest.cc
+++ b/services/device/hid/hid_connection_unittest.cc
@@ -279,7 +279,10 @@
 class HidConnectionProtectedReportTest : public testing::Test,
                                          HidConnection::Client {
  public:
-  HidConnectionProtectedReportTest() = default;
+  HidConnectionProtectedReportTest() {
+    scoped_feature_list_.InitAndEnableFeature(
+        features::kWebHidRecursiveFiltering);
+  }
   HidConnectionProtectedReportTest(const HidConnectionProtectedReportTest&) =
       delete;
   HidConnectionProtectedReportTest& operator=(
@@ -353,6 +356,7 @@
   scoped_refptr<TestHidConnection> connection_;
   base::test::TestFuture<scoped_refptr<base::RefCountedBytes>, size_t>
       input_report_future_;
+  base::test::ScopedFeatureList scoped_feature_list_;
 };
 
 TEST_F(HidConnectionProtectedReportTest, UnprotectedReadWrite) {
@@ -599,4 +603,91 @@
   EXPECT_TRUE(connection().closed());
 }
 
+TEST_F(HidConnectionProtectedReportTest, FidoReportsInNestedCollectionBlocked) {
+  // Simulate a device with a vendor-defined top-level collection containing a
+  // nested FIDO application collection that defines input and output reports.
+  auto device_info =
+      CreateHidDeviceInfo(TestReportDescriptors::VendorWithNestedFido());
+  ASSERT_TRUE(device_info);
+  ASSERT_EQ(device_info->collections().size(), 1u);
+  EXPECT_EQ(device_info->collections()[0]->usage->usage_page,
+            mojom::kPageVendor);
+  CreateConnection(device_info);
+
+  SetConnectionClient();
+
+  // Simulate an input report from the nested FIDO collection. It should not be
+  // received by the client.
+  auto buffer =
+      base::MakeRefCounted<base::RefCountedBytes>(std::vector<uint8_t>{1});
+  connection().SimulateInputReport(buffer);
+  EXPECT_FALSE(HasNextInputReport());
+
+  // Try to write an output report to the nested FIDO collection. It should be
+  // blocked.
+  TestFuture<bool> write_future;
+  connection().Write(buffer, write_future.GetCallback());
+  EXPECT_FALSE(write_future.Get());
+
+  // Close the connection.
+  connection().Close();
+  EXPECT_TRUE(connection().closed());
+}
+
+TEST_F(HidConnectionProtectedReportTest,
+       AllowFidoReportsAllowsFidoInNestedCollection) {
+  // Simulate a device with a vendor-defined top-level collection containing a
+  // nested FIDO application collection that defines input and output reports.
+  auto device_info =
+      CreateHidDeviceInfo(TestReportDescriptors::VendorWithNestedFido());
+  ASSERT_TRUE(device_info);
+
+  // Simulate a connection from a FIDO-privileged origin.
+  CreateConnection(device_info, /*allow_protected_reports=*/false,
+                   /*allow_fido_reports=*/true);
+
+  // Simulate an input report.
+  TestFuture<bool, scoped_refptr<base::RefCountedBytes>, size_t> read_future;
+  auto buffer =
+      base::MakeRefCounted<base::RefCountedBytes>(std::vector<uint8_t>{1});
+  connection().SimulateInputReport(buffer);
+  connection().Read(read_future.GetCallback());
+  EXPECT_TRUE(read_future.Get<0>());
+
+  // Simulate an output report.
+  TestFuture<bool> write_future;
+  connection().Write(buffer, write_future.GetCallback());
+  EXPECT_TRUE(write_future.Get());
+
+  // Close the connection.
+  connection().Close();
+  EXPECT_TRUE(connection().closed());
+}
+
+TEST_F(HidConnectionProtectedReportTest,
+       KeyboardReportsInNestedCollectionBlocked) {
+  // Simulate a device with a vendor-defined top-level collection containing a
+  // nested keyboard application collection that defines an input report.
+  auto device_info =
+      CreateHidDeviceInfo(TestReportDescriptors::VendorWithNestedKeyboard());
+  ASSERT_TRUE(device_info);
+  ASSERT_EQ(device_info->collections().size(), 1u);
+  EXPECT_EQ(device_info->collections()[0]->usage->usage_page,
+            mojom::kPageVendor);
+  CreateConnection(device_info);
+
+  SetConnectionClient();
+
+  // Simulate an input report from the nested keyboard collection. It should
+  // not be received by the client.
+  auto buffer =
+      base::MakeRefCounted<base::RefCountedBytes>(std::vector<uint8_t>{1});
+  connection().SimulateInputReport(buffer);
+  EXPECT_FALSE(HasNextInputReport());
+
+  // Close the connection.
+  connection().Close();
+  EXPECT_TRUE(connection().closed());
+}
+
 }  // namespace device
diff --git a/services/device/hid/hid_device_info_unittest.cc b/services/device/hid/hid_device_info_unittest.cc
index 05df2c4c..315b7172 100644
--- a/services/device/hid/hid_device_info_unittest.cc
... (truncated)