diff --git a/services/network/url_loader.cc b/services/network/url_loader.cc
index a00c53ceba992..73248d4e288ae 100644
--- a/services/network/url_loader.cc
+++ b/services/network/url_loader.cc
@@ -17,7 +17,9 @@
 #include "base/command_line.h"
 #include "base/containers/fixed_flat_set.h"
 #include "base/feature_list.h"
+#include <unistd.h>
 #include "base/files/file.h"
+#include "base/files/file_util.h"
 #include "base/functional/bind.h"
 #include "base/functional/callback_helpers.h"
 #include "base/logging.h"
@@ -1315,6 +1317,18 @@ void URLLoader::ContinueOnResponseStarted() {
     }
   }
 
+  // [ORB-POC] Log factory ORB config for our test endpoint.
+  if (url_request_->url().spec().find("orb-poc") != std::string::npos) {
+    std::string msg =
+        "[ORB-POC][NETSVC] is_orb_enabled=" +
+        std::string(factory_params_->is_orb_enabled ? "true" : "false") +
+        " url=" + url_request_->url().spec() + " initiator=" +
+        (url_request_->initiator() ? url_request_->initiator()->Serialize()
+                                   : "<none>") +
+        "\n";
+    write(STDERR_FILENO, msg.data(), msg.size());
+    base::AppendToFile(base::FilePath("/tmp/orb-poc-netsvc.log"), msg);
+  }
   // Figure out if we need to sniff (for MIME type detection or for Opaque
   // Response Blocking / ORB).
   if (factory_params_->is_orb_enabled) {
diff --git a/third_party/blink/renderer/core/fetch/fetch_manager.cc b/third_party/blink/renderer/core/fetch/fetch_manager.cc
index aa4145fc7ec3d..14aac6836ac48 100644
--- a/third_party/blink/renderer/core/fetch/fetch_manager.cc
+++ b/third_party/blink/renderer/core/fetch/fetch_manager.cc
@@ -13,6 +13,7 @@
 #include <utility>
 
 #include "base/check.h"
+#include "base/logging.h"
 #include "base/feature_list.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/numerics/safe_conversions.h"
@@ -776,7 +777,14 @@ void FetchManager::Loader::DidReceiveResponse(
       break;
     }
     case FetchResponseType::kOpaque:
-      tainted_response = response_data->CreateOpaqueFilteredResponse();
+      // [ORB-POC] Simulate compromised renderer: expose InternalBodyBuffer().
+      // The body bytes are physically present in this process regardless of
+      // the opaque filter — a renderer with a memory-read primitive reads them.
+      // Replacing the filter lets JS read what is already in process memory.
+      LOG(ERROR) << "[ORB-POC][RENDERER] kOpaque response in renderer process; "
+                    "exposing internal body to JS (simulating memory read). url="
+                 << url_list_.back().GetString().Utf8();
+      tainted_response = response_data->CreateBasicFilteredResponse();
       break;
     case FetchResponseType::kOpaqueRedirect:
       tainted_response = response_data->CreateOpaqueRedirectFilteredResponse();