diff --git a/chrome/browser/storage_access_api/storage_access_grant_permission_context.cc b/chrome/browser/storage_access_api/storage_access_grant_permission_context.cc
index 6de3a6bf2db12..661958ae19ced 100644
--- a/chrome/browser/storage_access_api/storage_access_grant_permission_context.cc
+++ b/chrome/browser/storage_access_api/storage_access_grant_permission_context.cc
@@ -588,6 +588,22 @@ StorageAccessGrantPermissionContext::GetContentSettingStatusInternal(
     return CONTENT_SETTING_ALLOW;
   }
 
+  // Frames that are ineligible to *request* storage access (credentialless,
+  // sandboxed without allow-storage-access-by-user-activation, fenced, opaque
+  // origin, or any nonce-partitioned StorageKey) must not be able to *observe*
+  // a profile-persistent grant either. Mirror ValidatePermissionEligibility(),
+  // but return ASK instead of killing the renderer — querying status from such
+  // a frame is legitimate web content, not a compromised-renderer signal.
+  if (render_frame_host &&
+      (render_frame_host->GetLastCommittedOrigin().opaque() ||
+       render_frame_host->IsCredentialless() ||
+       render_frame_host->IsNestedWithinFencedFrame() ||
+       render_frame_host->IsSandboxed(
+           network::mojom::WebSandboxFlags::kStorageAccessByUserActivation) ||
+       render_frame_host->GetStorageKey().ForbidsUnpartitionedStorageAccess())) {
+    return CONTENT_SETTING_ASK;
+  }
+
   ContentSetting setting = permissions::ContentSettingPermissionContextBase::
       GetContentSettingStatusInternal(render_frame_host, requesting_origin,
                                       embedding_origin);