diff --git a/chrome/browser/hid/hid_chooser_context.cc b/chrome/browser/hid/hid_chooser_context.cc
index 88d3d33b178f0..6d86e327617c8 100644
--- a/chrome/browser/hid/hid_chooser_context.cc
+++ b/chrome/browser/hid/hid_chooser_context.cc
@@ -481,7 +481,11 @@ bool HidChooserContext::HasDevicePermission(
     }
   }
 
-  if (CanApplyPolicy() &&
+  // Do not let enterprise policy short-circuit when the request originates
+  // from a <webview>/<controlledframe> guest: the embedder must mediate every
+  // device grant via WebViewChooserContext, otherwise a malicious IWA could
+  // navigate its guest to a policy-allowlisted origin and hijack the device.
+  if (CanApplyPolicy() && !embedding_origin_of_web_view &&
       HidPolicyAllowedDevicesFactory::GetForProfile(profile_)
           ->HasDevicePermission(origin, device)) {
     return true;