diff --git a/third_party/blink/renderer/platform/loader/fetch/url_loader/resource_request_sender.cc b/third_party/blink/renderer/platform/loader/fetch/url_loader/resource_request_sender.cc
index e8661061a45f7..5a00a8eb7f7fe 100644
--- a/third_party/blink/renderer/platform/loader/fetch/url_loader/resource_request_sender.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/url_loader/resource_request_sender.cc
@@ -277,6 +277,18 @@ int ResourceRequestSender::SendAsync(
 
   // Compute a unique request_id for this renderer process.
   int request_id = GenerateRequestId();
+  // ---- POC: simulate compromised renderer ----------------------------------
+  // A real compromised renderer fully controls the int32 request_id sent in
+  // URLLoaderFactory.CreateLoaderAndStart. Force a fixed colliding value for
+  // POC-tagged URLs so two concurrent subresource loads share the same
+  // network_service_request_id_ in WebRequestProxyingURLLoaderFactory.
+  if (request->url.spec().find("dupreqid") != std::string::npos) {
+    request_id = 424242;
+    request->do_not_prompt_for_login = false;
+    LOG(ERROR) << "[POC compromised renderer] forcing request_id=" << request_id
+               << " for " << request->url.spec();
+  }
+  // --------------------------------------------------------------------------
   request_info_ = std::make_unique<PendingRequestInfo>(
       std::move(client), request->destination, KURL(request->url),
       std::move(resource_load_info_notifier_wrapper));