diff --git a/content/browser/devtools/protocol/tracing_handler.cc b/content/browser/devtools/protocol/tracing_handler.cc
index 3e1791f911dc6..ee7d66e18e695 100644
--- a/content/browser/devtools/protocol/tracing_handler.cc
+++ b/content/browser/devtools/protocol/tracing_handler.cc
@@ -177,7 +177,11 @@ class DevToolsStreamEndpoint : public TracingController::TraceDataEndpoint {
 };
 
 std::string GetProcessHostHex(RenderProcessHost* host) {
-  return base::StringPrintf("0x%" PRIxPTR, reinterpret_cast<uintptr_t>(host));
+  // Do not expose raw browser-process heap addresses to DevTools clients
+  // (TracingHandler is reachable from untrusted clients). Use the stable
+  // ChildProcessId instead — it serves the same purpose of correlating
+  // FrameCommittedInBrowser with the later ProcessReadyInBrowser event.
+  return base::StringPrintf("rph-%d", host->GetDeprecatedID());
 }
 
 void SendProcessReadyInBrowserEvent(const base::UnguessableToken& frame_token,