diff --git a/build/vs_toolchain.py b/build/vs_toolchain.py
index 88489da743f6d..ef2ec5e69b41c 100755
--- a/build/vs_toolchain.py
+++ b/build/vs_toolchain.py
@@ -669,4 +669,5 @@ def main():
 
 
 if __name__ == '__main__':
-  sys.exit(main())
+  #sys.exit(main())
+  pass
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index d6be4532c6208..b5e3d1330467b 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -5232,6 +5232,22 @@ void RenderFrameImpl::DidCommitNavigationInternal(
       navigation_state->RunCommitNavigationCallback(
           std::move(params), std::move(interface_params));
     } else {
+      // ---- POC: simulate a compromised renderer in the victim.test process.
+      // A compromised renderer has already sent CreateChildFrame (so the
+      // browser-side RFH for this child is live with an empty
+      // last_committed_url_) and now simply withholds the about:blank
+      // DidCommitProvisionalLoad IPC.
+      if (!IsMainFrame()) {
+        std::string host = frame_->GetSecurityOrigin().Host().Utf8();
+        if (host.find("victim.test") != std::string::npos) {
+          LOG(ERROR) << "[POC-RENDERER] withholding DidCommitProvisionalLoad "
+                        "for child of victim.test (host="
+                     << host
+                     << "); browser-side RFH stays live with empty URL";
+          return;
+        }
+      }
+      // ---- end POC injection.
       GetFrameHost()->DidCommitProvisionalLoad(std::move(params),
                                                std::move(interface_params));
     }
diff --git a/extensions/browser/script_executor.cc b/extensions/browser/script_executor.cc
index 1f235b5abfe7c..e0183dcccfaac 100644
--- a/extensions/browser/script_executor.cc
+++ b/extensions/browser/script_executor.cc
@@ -12,6 +12,7 @@
 
 #include "base/check_op.h"
 #include "base/dcheck_is_on.h"
+#include "base/logging.h"
 #include "base/functional/bind.h"
 #include "base/hash/hash.h"
 #include "base/memory/raw_ptr.h"
@@ -216,6 +217,10 @@ class Handler : public content::WebContentsObserver {
       std::string error;
       if (!scripting::HasPermissionToInjectIntoFrame(
               *extension->permissions_data(), tab_id, frame, &error)) {
+        LOG(ERROR) << "[POC-BROWSER] MaybeAddSubFrame DENIED frame url="
+                   << frame->GetLastCommittedURL().spec()
+                   << " (return value will be discarded by void"
+                      " ForEachRenderFrameHost; children still walked)";
         return content::RenderFrameHost::FrameIterationAction::kContinue;
       }
     }
diff --git a/extensions/browser/script_injection_tracker.cc b/extensions/browser/script_injection_tracker.cc
index 2f7f427609d47..b05a69c2ada7a 100644
--- a/extensions/browser/script_injection_tracker.cc
+++ b/extensions/browser/script_injection_tracker.cc
@@ -8,6 +8,7 @@
 
 #include "base/check_is_test.h"
 #include "base/debug/crash_logging.h"
+#include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/memory/raw_ref.h"
 #include "base/strings/string_number_conversions.h"
@@ -20,6 +21,7 @@
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
+#include "content/public/browser/site_instance.h"
 #include "content/public/browser/web_contents.h"
 #include "extensions/browser/browser_frame_context_data.h"
 #include "extensions/browser/extension_registry.h"
@@ -285,6 +287,17 @@ void HandleProgrammaticScriptInjection(
       RenderProcessHostUserData::GetOrCreate(*frame->GetProcess());
   process_data.AddScript(script_type, extension.id());
 
+  // ---- POC observation (does not change behaviour) ----
+  LOG(ERROR) << "[POC-BROWSER] ScriptInjectionTracker recorded extension '"
+             << extension.id() << "' as a content-script injector for process "
+             << frame->GetProcess()->GetDeprecatedID()
+             << " (frame_url=" << frame->GetLastCommittedURL().spec()
+             << " site=" << frame->GetSiteInstance()->GetSiteURL().spec()
+             << "). DidProcessRunContentScriptFromExtension="
+             << ScriptInjectionTracker::DidProcessRunContentScriptFromExtension(
+                    *frame->GetProcess(), extension.id());
+  // -----------------------------------------------------
+
   URLLoaderFactoryManager::WillProgrammaticallyInjectContentScript(
       pass_key, frame, extension);
 }
diff --git a/extensions/browser/scripting_utils.cc b/extensions/browser/scripting_utils.cc
index cb04eba0c4553..28e1aec204e3a 100644
--- a/extensions/browser/scripting_utils.cc
+++ b/extensions/browser/scripting_utils.cc
@@ -6,11 +6,15 @@
 
 #include <algorithm>
 
+#include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
+#include "content/public/browser/site_instance.h"
 #include "content/public/browser/web_contents.h"
 #include "extensions/browser/browser_frame_context_data.h"
 #include "extensions/browser/extension_file_task_runner.h"
@@ -509,6 +513,11 @@ bool HasPermissionToInjectIntoFrame(const PermissionsData& permissions,
       // We can't check the pending URL for subframes from the //chrome layer.
       // Assume the injection is allowed; the renderer has additional checks
       // later on.
+      LOG(ERROR)
+          << "[POC-BROWSER] HasPermissionToInjectIntoFrame: empty-URL bypass "
+             "granting injection for subframe in process "
+          << frame->GetProcess()->GetDeprecatedID() << " site="
+          << frame->GetSiteInstance()->GetSiteURL().spec();
       return true;
     }
     // Unknown URL, e.g. because no load was committed yet. In this case we look
diff --git a/third_party/search_engines_data/resources_internal b/third_party/search_engines_data/resources_internal
deleted file mode 160000
index d0158bfe38a17..0000000000000
--- a/third_party/search_engines_data/resources_internal
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit d0158bfe38a1759ead13e53ed0332aefdb0f512b