diff --git a/third_party/blink/renderer/modules/xr/xr_session.cc b/third_party/blink/renderer/modules/xr/xr_session.cc
index a66eb4f083b64..cb8dbce8b5baf 100644
--- a/third_party/blink/renderer/modules/xr/xr_session.cc
+++ b/third_party/blink/renderer/modules/xr/xr_session.cc
@@ -788,6 +788,13 @@ void XRSession::DispatchInitialEvents() {
 void XRSession::UpdateStageParameters(
     uint32_t stage_parameters_id,
     const device::mojom::blink::VRStageParametersPtr& stage_parameters) {
+  // POC: Simulate a compromised renderer reading the leaked browser-process
+  // heap bytes carried in XRFrameData.stage_parameters_id. On Android XR the
+  // OpenXrRenderLoop lives in the browser process, so this value crosses the
+  // browser->renderer trust boundary.
+  LOG(ERROR) << "POC-LEAK XRFrameData.stage_parameters_id=0x" << std::hex
+             << stage_parameters_id << " (" << std::dec << stage_parameters_id
+             << ")";
   // Only update if the ID is different, indicating a change.
   if (stage_parameters_id_ != stage_parameters_id) {
     stage_parameters_id_ = stage_parameters_id;