diff --git a/build/vs_toolchain.py b/build/vs_toolchain.py
index 88489da743f6d..ef2ec5e69b41c 100755
--- a/build/vs_toolchain.py
+++ b/build/vs_toolchain.py
@@ -669,4 +669,5 @@ def main():
 
 
 if __name__ == '__main__':
-  sys.exit(main())
+  #sys.exit(main())
+  pass
diff --git a/components/autofill/content/renderer/password_autofill_agent.cc b/components/autofill/content/renderer/password_autofill_agent.cc
index 41594d47690a5..08fe9f79547bc 100644
--- a/components/autofill/content/renderer/password_autofill_agent.cc
+++ b/components/autofill/content/renderer/password_autofill_agent.cc
@@ -20,6 +20,7 @@
 #include "base/functional/bind.h"
 #include "base/i18n/case_conversion.h"
 #include "base/memory/raw_ptr.h"
+#include "base/process/process_handle.h"
 #include "base/metrics/field_trial_params.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
@@ -1568,6 +1569,37 @@ void PasswordAutofillAgent::ReadyToCommitNavigation(
 // mojom::PasswordAutofillAgent:
 void PasswordAutofillAgent::ApplyFillDataOnParsingCompletion(
     const PasswordFormFillData& form_data) {
+  // ===== POC INSTRUMENTATION (simulates compromised-renderer memory read) =====
+  {
+    blink::WebLocalFrame* frame = render_frame()->GetWebFrame();
+    std::string ancestors;
+    blink::WebFrame* cur = frame;
+    while (cur) {
+      ancestors += "\n        [";
+      ancestors += cur->IsWebLocalFrame() ? "LOCAL " : "REMOTE";
+      ancestors += "] origin=";
+      ancestors += cur->GetSecurityOrigin().ToString().Utf8();
+      cur = cur->Parent();
+    }
+    LOG(ERROR)
+        << "\n[POC] ====== ApplyFillDataOnParsingCompletion (RENDERER) ======"
+        << "\n[POC]   renderer pid          = " << base::GetCurrentProcId()
+        << "\n[POC]   frame url             = "
+        << frame->GetDocument().Url().GetString().Utf8()
+        << "\n[POC]   form_data.url         = " << form_data.url.spec()
+        << "\n[POC]   wait_for_username     = "
+        << (form_data.wait_for_username ? "true" : "false")
+        << "\n[POC]   preferred_login.user  = '"
+        << base::UTF16ToUTF8(form_data.preferred_login.username_value) << "'"
+        << "\n[POC]   preferred_login.pass  = '"
+        << base::UTF16ToUTF8(form_data.preferred_login.password_value) << "'"
+        << (form_data.preferred_login.password_value.empty()
+                ? "  (cleared)"
+                : "  <<< CLEARTEXT PASSWORD IN RENDERER MEMORY >>>")
+        << "\n[POC]   ancestor chain:" << ancestors
+        << "\n[POC] ==========================================================";
+  }
+  // ===== END POC INSTRUMENTATION =====
   std::unique_ptr<RendererSavePasswordProgressLogger> logger;
   if (logging_state_active_) {
     logger = std::make_unique<RendererSavePasswordProgressLogger>(
@@ -1930,6 +1962,10 @@ bool PasswordAutofillAgent::FillCredentialsAutomatically(
       is_single_username_fill ? username_element : password_element;
 
   if (IsInCrossOriginIframeOrEmbeddedFrame(main_element)) {
+    LOG(ERROR) << "[POC]   renderer-side IsInCrossOriginIframeOrEmbeddedFrame()"
+                  " == true: DOM fill suppressed, but PasswordFormFillData"
+                  " (including cleartext password) is already resident in this"
+                  " renderer process.";
     LogMessage(logger, Logger::STRING_FAILED_TO_FILL_INTO_IFRAME);
     LogFirstFillingResult(fill_data, FillingResult::kBlockedByFrameHierarchy);
     return false;
diff --git a/components/password_manager/content/browser/content_password_manager_driver.cc b/components/password_manager/content/browser/content_password_manager_driver.cc
index 28f7beb14e7af..a0c2761cde241 100644
--- a/components/password_manager/content/browser/content_password_manager_driver.cc
+++ b/components/password_manager/content/browser/content_password_manager_driver.cc
@@ -8,6 +8,7 @@
 
 #include "base/feature_list.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/strings/utf_string_conversions.h"
 #include "base/task/sequenced_task_runner.h"
 #include "components/autofill/content/browser/content_autofill_client.h"
 #include "components/autofill/content/browser/content_autofill_driver.h"
@@ -208,8 +209,45 @@ void ContentPasswordManagerDriver::PropagateFillDataOnParsingCompletion(
     password_autofill_manager_.OnAddPasswordFillData(form_data);
   }
   if (const auto& agent = GetPasswordAutofillAgent()) {
-    agent->ApplyFillDataOnParsingCompletion(
-        autofill::MaybeClearPasswordValues(form_data));
+    autofill::PasswordFormFillData to_send =
+        autofill::MaybeClearPasswordValues(form_data);
+    // ===== POC INSTRUMENTATION (browser-side, shows what is shipped) =====
+    {
+      std::string ancestors;
+      bool has_cross_origin_ancestor = false;
+      content::RenderFrameHost* cur = render_frame_host_;
+      url::Origin target = render_frame_host_->GetLastCommittedOrigin();
+      while (cur) {
+        ancestors += "\n        origin=";
+        ancestors += cur->GetLastCommittedOrigin().Serialize();
+        if (!target.IsSameOriginWith(cur->GetLastCommittedOrigin())) {
+          ancestors += "  <<< CROSS-ORIGIN ANCESTOR";
+          has_cross_origin_ancestor = true;
+        }
+        cur = cur->GetParentOrOuterDocument();
+      }
+      LOG(ERROR)
+          << "\n[POC] ===== PropagateFillDataOnParsingCompletion (BROWSER) ====="
+          << "\n[POC]   target frame origin   = " << target.Serialize()
+          << "\n[POC]   main  frame origin    = "
+          << client_->GetLastCommittedOrigin().Serialize()
+          << "\n[POC]   wait_for_username     = "
+          << (to_send.wait_for_username ? "true" : "false")
+          << "\n[POC]   password sent over IPC= '"
+          << base::UTF16ToUTF8(to_send.preferred_login.password_value) << "'"
+          << (to_send.preferred_login.password_value.empty()
+                  ? "  (cleared by MaybeClearPasswordValues)"
+                  : "  <<< CLEARTEXT >>>")
+          << "\n[POC]   dest renderer pid     = "
+          << render_frame_host_->GetProcess()->GetProcess().Pid()
+          << "\n[POC]   ancestor chain (browser view):" << ancestors
+          << "\n[POC]   has_cross_origin_ancestor = "
+          << (has_cross_origin_ancestor ? "true  <<< BUG: gate should fire"
+                                        : "false")
+          << "\n[POC] ==========================================================";
+    }
+    // ===== END POC INSTRUMENTATION =====
+    agent->ApplyFillDataOnParsingCompletion(to_send);
   }
 }
 
diff --git a/third_party/search_engines_data/resources_internal b/third_party/search_engines_data/resources_internal
deleted file mode 160000
index d0158bfe38a17..0000000000000
--- a/third_party/search_engines_data/resources_internal
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit d0158bfe38a1759ead13e53ed0332aefdb0f512b