diff --git a/extensions/browser/script_executor.cc b/extensions/browser/script_executor.cc
index ea557e103e17e..6b94c3230b5fe 100644
--- a/extensions/browser/script_executor.cc
+++ b/extensions/browser/script_executor.cc
@@ -208,6 +208,17 @@ class Handler : public content::WebContentsObserver {
       return content::RenderFrameHost::FrameIterationAction::kContinue;
     }
 
+    // Skip subframes that are showing an error page (matching the
+    // explicit-frameIds path above). For renderer-initiated subframe
+    // navigations that fail with an IsRequestBlockedError code, the error
+    // document commits in the *initiating* process while
+    // GetLastCommittedURL() reports the destination URL, so the
+    // HasPermissionToInjectIntoFrame() check below would incorrectly allow
+    // the frame and poison ScriptInjectionTracker for an unrelated process.
+    if (frame->IsErrorDocument()) {
+      return content::RenderFrameHost::FrameIterationAction::kContinue;
+    }
+
     if (!is_web_view_ &&
         host_id_.type == mojom::HostID::HostType::kExtensions) {
       // TODO(crbug.com/502262220): We do permission checks in at least three