diff --git a/url/BUILD.gn b/url/BUILD.gn
--- a/url/BUILD.gn
+++ b/url/BUILD.gn
@@ -191,6 +191,7 @@
 test("url_unittests") {
   sources = [
+    "gurl_poc_test.cc",
     "gurl_unittest.cc",
     "origin_unittest.cc",
     "run_all_unittests.cc",
diff --git a/url/gurl_poc_test.cc b/url/gurl_poc_test.cc
new file mode 100644
--- /dev/null
+++ b/url/gurl_poc_test.cc
@@ -0,0 +1,17 @@
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+#include <stdio.h>
+#include <string>
+
+TEST(WebAddressParserPoc, HostConfusion) {
+  GURL input("https://victim.com:@evil.com/");
+  GURL output("https://victim.com/@evil.com/");
+  std::string in_host(input.host());
+  std::string out_host(output.host());
+  fprintf(stderr,
+          "[POC] GURL(input  'https://victim.com:@evil.com/').host()  = '%s'\n", in_host.c_str());
+  fprintf(stderr,
+          "[POC] GURL(output 'https://victim.com/@evil.com/').host()  = '%s'\n", out_host.c_str());
+  EXPECT_EQ(in_host, "evil.com");
+  EXPECT_EQ(out_host, "victim.com");
+}