diff --git a/ios/web/webui/crw_web_ui_scheme_handler_unittest.mm b/ios/web/webui/crw_web_ui_scheme_handler_unittest.mm
index 0000000..0000001 100644
--- a/ios/web/webui/crw_web_ui_scheme_handler_unittest.mm
+++ b/ios/web/webui/crw_web_ui_scheme_handler_unittest.mm
@@ -296,4 +296,49 @@ TEST_F(CRWWebUISchemeManagerTest, CheckMimetypeOfChromeScheme) {
   EXPECT_FALSE(url_scheme_task.receivedError);
 }

+// POC: Demonstrates that CRWWebUISchemeHandler drops the X-Frame-Options and
+// Content-Security-Policy headers that URLDataManagerIOSBackend defines for
+// chrome:// responses, and instead emits Access-Control-Allow-Origin: *.
+// As a result, on iOS any chrome:// page can be framed by any other chrome://
+// page (no XFO:DENY enforcement by WKWebView), and any origin that can issue
+// the fetch may CORS-read chrome:// resources.
+TEST_F(CRWWebUISchemeManagerTest, POC_MissingXFOAndCSPHeaders) {
+  CRWWebUISchemeHandler* scheme_handler = CreateSchemeHandler();
+  id web_view = OCMClassMock([WKWebView class]);
+  FakeSchemeTask* url_scheme_task = [[FakeSchemeTask alloc] init];
+
+  NSMutableURLRequest* request = [NSMutableURLRequest
+      requestWithURL:[NSURL URLWithString:@"chrome://version/"]];
+  request.mainDocumentURL = [NSURL URLWithString:@"chrome://version/"];
+  url_scheme_task.request = request;
+
+  [scheme_handler webView:web_view startURLSchemeTask:url_scheme_task];
+  RespondWithData(net::GURLWithNSURL(request.URL), "<html></html>");
+
+  ASSERT_TRUE(url_scheme_task.receivedData);
+  ASSERT_TRUE(
+      [url_scheme_task.response isKindOfClass:NSHTTPURLResponse.class]);
+  NSHTTPURLResponse* http_response =
+      static_cast<NSHTTPURLResponse*>(url_scheme_task.response);
+  NSDictionary* headers = http_response.allHeaderFields;
+
+  // BUG #1: url_data_manager_ios_backend.mm declares
+  // kChromeURLXFrameOptionsHeader = "DENY" for chrome:// responses, but the
+  // scheme handler builds its own NSHTTPURLResponse and never propagates it.
+  // WKWebView therefore allows this document to be rendered in an <iframe>.
+  EXPECT_EQ(nil, headers[@"X-Frame-Options"])
+      << "VULN CONFIRMED: X-Frame-Options is absent on chrome:// response";
+
+  // BUG #2: per-data-source Content-Security-Policy
+  // (kChromeURLContentSecurityPolicyHeaderBase) is also dropped.
+  EXPECT_EQ(nil, headers[@"Content-Security-Policy"])
+      << "VULN CONFIRMED: Content-Security-Policy is absent";
+
+  // BUG #3: the handler unconditionally sets ACAO:* on every chrome://
+  // response, allowing cross-origin reads from any origin able to fetch it.
+  EXPECT_NSEQ(@"*", headers[@"Access-Control-Allow-Origin"])
+      << "VULN CONFIRMED: Access-Control-Allow-Origin is wildcard";
+}
+
 }  // namespace web