diff --git a/third_party/blink/renderer/platform/media/resource_multi_buffer_data_provider.cc b/third_party/blink/renderer/platform/media/resource_multi_buffer_data_provider.cc
index 61b798d0b3758..0cb903454b0bd 100644
--- a/third_party/blink/renderer/platform/media/resource_multi_buffer_data_provider.cc
+++ b/third_party/blink/renderer/platform/media/resource_multi_buffer_data_provider.cc
@@ -181,6 +181,11 @@ bool ResourceMultiBufferDataProvider::WillFollowRedirect(
     const WebURL& new_url,
     const WebURLResponse& redirect_response) {
   DVLOG(1) << "willFollowRedirect";
+  LOG(ERROR) << "[POC] WillFollowRedirect: original_url_="
+             << original_url_.GetString().Utf8()
+             << " current url_data_=" << url_data_->url().GetString().Utf8()
+             << " url_data_blocks=" << url_data_->multibuffer()->map().size()
+             << " redirecting_to=" << KURL(new_url).GetString().Utf8();
   redirects_to_ = new_url;
   url_data_->set_valid_until(base::Time::Now() +
                              GetCacheValidUntil(redirect_response));
@@ -323,6 +328,13 @@ void ResourceMultiBufferDataProvider::DidReceiveResponse(
         url_data_->url_index()->TryInsert(destination_url_data);
   }
 
+  LOG(ERROR) << "[POC] DidReceiveResponse: url_data_="
+             << url_data_->url().GetString().Utf8()
+             << " destination=" << destination_url_data->url().GetString().Utf8()
+             << " response_type=" << static_cast<int>(response_type)
+             << " IsCorsCrossOriginResponseType="
+             << network::cors::IsCorsCrossOriginResponseType(response_type)
+             << " was_via_sw=" << response.WasFetchedViaServiceWorker();
   // This is vital for security!
   destination_url_data->set_is_cors_cross_origin(
       network::cors::IsCorsCrossOriginResponseType(response_type));
@@ -463,6 +475,11 @@ void ResourceMultiBufferDataProvider::DidFinishLoading() {
       size < url_data_->length()) {
     if (retries_ < kMaxRetries) {
       DVLOG(1) << " Partial data received.... @ pos = " << size;
+      LOG(ERROR) << "[POC] DidFinishLoading partial-retry: url_data_="
+                 << url_data_->url().GetString().Utf8()
+                 << " byte_pos=" << size
+                 << " length=" << url_data_->length()
+                 << " original_url_=" << original_url_.GetString().Utf8();
       retries_++;
       task_runner_->PostDelayedTask(
           FROM_HERE,
diff --git a/third_party/blink/renderer/platform/media/url_index.cc b/third_party/blink/renderer/platform/media/url_index.cc
index 410b0ae8be948..485a651a2aa49 100644
--- a/third_party/blink/renderer/platform/media/url_index.cc
+++ b/third_party/blink/renderer/platform/media/url_index.cc
@@ -147,7 +147,28 @@ void UrlData::set_passed_timing_allow_origin_check(
 void UrlData::RedirectTo(const scoped_refptr<UrlData>& url_data) {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   // Copy any cached data over to the new location.
+  size_t src_blocks = multibuffer()->map().size();
+  size_t dst_before = url_data->multibuffer()->map().size();
   url_data->multibuffer()->MergeFrom(multibuffer());
+  size_t dst_after = url_data->multibuffer()->map().size();
+  LOG(ERROR) << "[POC] UrlData::RedirectTo MERGE: src_url="
+             << url_.GetString().Utf8()
+             << " src_is_cors_cross_origin=" << is_cors_cross_origin_
+             << " src_blocks=" << src_blocks
+             << " -> dst_url=" << url_data->url_.GetString().Utf8()
+             << " dst_is_cors_cross_origin="
+             << url_data->is_cors_cross_origin_
+             << " dst_blocks_before=" << dst_before
+             << " dst_blocks_after=" << dst_after;
+  if (dst_after > dst_before && is_cors_cross_origin_ &&
+      !url_data->is_cors_cross_origin_ &&
+      !SecurityOrigin::AreSameOrigin(url_, url_data->url_)) {
+    LOG(ERROR) << "[POC] *** VULNERABILITY TRIGGERED *** opaque cross-origin "
+                  "bytes ("
+               << (dst_after - dst_before)
+               << " block(s)) merged into UNTAINTED UrlData for "
+               << url_data->url_.GetString().Utf8();
+  }
 
   Vector<RedirectCB> redirect_callbacks;
   redirect_callbacks.swap(redirect_callbacks_);