diff --git a/services/network/public/cpp/sri_message_signatures.cc b/services/network/public/cpp/sri_message_signatures.cc
index 8445b1f07d72b..625907a262b06 100644
--- a/services/network/public/cpp/sri_message_signatures.cc
+++ b/services/network/public/cpp/sri_message_signatures.cc
@@ -806,6 +806,13 @@ bool ValidateSRIMessageSignaturesOverHeaders(
     std::string signature_base =
         ConstructSignatureBase(message_signature, url_request, headers)
             .value_or("");
+    // POC INSTRUMENTATION: surface the empty-base condition.
+    // ConstructSignatureBase returned nullopt (e.g. declared header component
+    // absent from response). .value_or("") collapsed it to "". We're about to
+    // call ED25519_verify over a 0-byte message instead of failing per
+    // RFC 9421 sec. 2.5.
+    LOG(ERROR) << "[SRI-POC] signature_base.size()=" << signature_base.size()
+               << " url=" << url_request.url().spec();
 
     // Decode the public key, and validate that both the public key and the
     // message's signature are the correct length for Ed25519 (32 and 64 bits,
@@ -821,10 +828,20 @@ bool ValidateSRIMessageSignaturesOverHeaders(
     }
 
     // Verify the key and the signature over the signature base:
-    if (!ED25519_verify(reinterpret_cast<const uint8_t*>(signature_base.data()),
-                        signature_base.size(),
-                        message_signature->signature.data(),
-                        public_key.data())) {
+    int verify_ok = ED25519_verify(
+        reinterpret_cast<const uint8_t*>(signature_base.data()),
+        signature_base.size(), message_signature->signature.data(),
+        public_key.data());
+    LOG(ERROR) << "[SRI-POC] ED25519_verify(msg_len="
+               << signature_base.size() << ") -> " << verify_ok
+               << " url=" << url_request.url().spec();
+    if (signature_base.empty() && verify_ok) {
+      LOG(ERROR) << "[SRI-POC] *** BYPASS *** Ed25519 signature verified over "
+                    "EMPTY base. ConstructSignatureBase returned nullopt but "
+                    ".value_or(\"\") collapsed it. Validation should have "
+                    "FAILED per RFC 9421 sec. 2.5 -- instead it PASSES.";
+    }
+    if (!verify_ok) {
       auto issue = mojom::SRIMessageSignatureIssue::New();
       issue->error =
           mojom::SRIMessageSignatureError::kValidationFailedSignatureMismatch;