diff --git a/net/spdy/spdy_session.h b/net/spdy/spdy_session.h
index baad4810c0d3e..c0ebf6c850015 100644
--- a/net/spdy/spdy_session.h
+++ b/net/spdy/spdy_session.h
@@ -99,7 +99,11 @@ const spdy::SpdyStreamId kLastStreamId = 0x7fffffff;
 // 10^-8 of cases. Therefore we picked 10000 as a number that will
 // virtually never be hit in practice, while still preventing an
 // attacker from growing this queue unboundedly.
-const int kSpdySessionMaxQueuedCappedFrames = 10000;
+// POC: Lowered from 10000 to make iterator-UAF triggerable within one
+// 8KB read buffer (101 PINGs + 1 WINDOW_UPDATE = ~1730 bytes).
+// The original attack works at 10000 with TCP zero-window stalling
+// but this simplification proves the same code path.
+const int kSpdySessionMaxQueuedCappedFrames = 100;
 
 // Default time to delay sending small receive window updates (can be
 // configured through SetTimeToBufferSmallWindowUpdates()). Usually window