diff --git a/chrome/browser/devtools/devtools_ui_bindings.cc b/chrome/browser/devtools/devtools_ui_bindings.cc
--- a/chrome/browser/devtools/devtools_ui_bindings.cc
+++ b/chrome/browser/devtools/devtools_ui_bindings.cc
@@ -1271,10 +1271,18 @@ void DevToolsUIBindings::LoadNetworkResource(DispatchCallback callback,

   NetworkResourceLoader::URLLoaderFactoryHolder url_loader_factory;
   if (gurl.SchemeIsFile()) {
+    // A "remote" front-end (served from the appspot CDN via the
+    // devtools://devtools/remote/ proxy path) must not be allowed to read
+    // arbitrary local files. The committed URL at this point is always a
+    // devtools:// URL (an https:// commit would have failed
+    // IsValidFrontendURL() and reset frontend_host_, making this method
+    // unreachable), so detect the remote case by its proxy path prefix.
     GURL frontend_url = web_contents_->GetLastCommittedURL();
+    const std::string remote_prefix =
+        std::string("/") + chrome::kChromeUIDevToolsRemotePath + "/";
     bool is_remote_frontend =
-        frontend_url.is_valid() && !frontend_url.IsAboutBlank() &&
-        IsValidRemoteFrontendURL(frontend_url);
+        frontend_url.SchemeIs(content::kChromeDevToolsScheme) &&
+        base::StartsWith(frontend_url.GetPath(), remote_prefix);
     if (is_remote_frontend) {
       if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
               switches::kAllowUnsafeDevToolsRemoteFileLoading)) {