diff --git a/chrome/browser/password_manager/password_change/cross_origin_navigation_observer.cc b/chrome/browser/password_manager/password_change/cross_origin_navigation_observer.cc
index d012cd23aa883..20d4e0758a56b 100644
--- a/chrome/browser/password_manager/password_change/cross_origin_navigation_observer.cc
+++ b/chrome/browser/password_manager/password_change/cross_origin_navigation_observer.cc
@@ -73,8 +73,15 @@ void CrossOriginNavigationObserver::NavigationEntryCommitted(
 
 bool CrossOriginNavigationObserver::IsSameOrAffiliatedDomain(
     const GURL& url) const {
-  return affiliated_domains_.contains(
-      affiliations::GetExtendedTopLevelDomain(url, psl_extension_list_));
+  std::string domain =
+      affiliations::GetExtendedTopLevelDomain(url, psl_extension_list_);
+  // An empty eTLD+1 (IP literals, single-label hosts, non-standard schemes,
+  // android:// facets) must never count as an affiliation match. See
+  // affiliations::IsExtendedPublicSuffixDomainMatch for the same guard.
+  if (domain.empty()) {
+    return false;
+  }
+  return affiliated_domains_.contains(domain);
 }
 
 void CrossOriginNavigationObserver::OnPSLExtensionsReceived(