diff --git a/third_party/blink/common/loader/url_loader_factory_bundle.cc b/third_party/blink/common/loader/url_loader_factory_bundle.cc
index 0000000000..1111111111 100644
--- a/third_party/blink/common/loader/url_loader_factory_bundle.cc
+++ b/third_party/blink/common/loader/url_loader_factory_bundle.cc
@@ -84,8 +84,28 @@ URLLoaderFactoryBundle::URLLoaderFactoryBundle(
 URLLoaderFactoryBundle::~URLLoaderFactoryBundle() = default;

 network::mojom::URLLoaderFactory* URLLoaderFactoryBundle::GetFactory(
     const network::ResourceRequest& request) {
+  // ----------------------------------------------------------------------
+  // POC: Simulate a compromised renderer in a multi-network CCT.
+  //
+  // In a multi-network CCT, the browser hands the renderer a per-scheme
+  // URLLoaderFactory for "data" whose terminal endpoint is a
+  // CorsURLLoaderFactory created with:
+  //   process_id = browser(), is_trusted = true, disable_web_security = true
+  // (see chrome_content_browser_client.cc MaybeProxyNetworkBoundRequest,
+  //  single-layer / !factory_override branch).
+  //
+  // A real compromised renderer would grab the raw Mojo pipe and send an
+  // arbitrary https:// ResourceRequest down it. We simulate that here by
+  // routing any request whose URL query contains "use-data-factory" through
+  // the "data" scheme-specific factory instead of the default factory.
+  // ----------------------------------------------------------------------
+  if (request.url.query_piece().find("use-data-factory") !=
+      std::string::npos) {
+    auto poc_it = scheme_specific_factories_.find("data");
+    if (poc_it != scheme_specific_factories_.end()) {
+      LOG(ERROR) << "[POC] Routing " << request.url
+                 << " through data:// scheme factory (browser-trusted, "
+                    "CORS-disabled in multi-network CCT)";
+      return poc_it->second.get();
+    }
+  }
+
   auto it = scheme_specific_factories_.find(request.url.GetScheme());
   if (it != scheme_specific_factories_.end())
     return it->second.get();