diff --git a/components/password_manager/core/browser/password_manager.cc b/components/password_manager/core/browser/password_manager.cc
index 46a1bbfad4fc8..f5dc51a6d0188 100644
--- a/components/password_manager/core/browser/password_manager.cc
+++ b/components/password_manager/core/browser/password_manager.cc
@@ -1156,6 +1156,12 @@ PasswordFormManager* PasswordManager::CreateFormManager(
     return nullptr;
   }
 
+  // Frames with an opaque origin (e.g. sandboxed iframes) cannot be matched
+  // against stored credentials, so there is nothing to manage for them.
+  if (driver && driver->GetLastCommittedOrigin().opaque()) {
+    return nullptr;
+  }
+
   auto manager = std::make_unique<PasswordFormManager>(
       client_,
       driver ? driver->AsWeakPtr() : base::WeakPtr<PasswordManagerDriver>(),
diff --git a/components/password_manager/core/browser/password_manager_unittest.cc b/components/password_manager/core/browser/password_manager_unittest.cc
index 58955f0d8082e..fabbd05ee3704 100644
--- a/components/password_manager/core/browser/password_manager_unittest.cc
+++ b/components/password_manager/core/browser/password_manager_unittest.cc
@@ -5782,6 +5782,8 @@ TEST_P(PasswordManagerTest, FormSubmittedOnIFrame) {
   MockPasswordManagerDriver iframe_driver;
   ON_CALL(iframe_driver, IsInPrimaryMainFrame()).WillByDefault(Return(false));
   ON_CALL(iframe_driver, GetId()).WillByDefault(Return(DriverId(123)));
+  ON_CALL(iframe_driver, GetLastCommittedOrigin)
+      .WillByDefault(ReturnRef(test_form_origin_));
   manager()->OnPasswordFormsParsed(&iframe_driver, {form_data});
   manager()->OnPasswordFormSubmitted(&iframe_driver, form_data);
   task_environment_.RunUntilIdle();
@@ -5813,6 +5815,8 @@ TEST_P(PasswordManagerTest, FormSubmittedOnIFramePrimaryMainFrameLoaded) {
   MockPasswordManagerDriver iframe_driver;
   ON_CALL(iframe_driver, IsInPrimaryMainFrame()).WillByDefault(Return(false));
   ON_CALL(iframe_driver, GetId()).WillByDefault(Return(DriverId(123)));
+  ON_CALL(iframe_driver, GetLastCommittedOrigin)
+      .WillByDefault(ReturnRef(test_form_origin_));
   manager()->OnPasswordFormsParsed(&iframe_driver, {form_data});
   manager()->OnPasswordFormSubmitted(&iframe_driver, form_data);
   task_environment_.RunUntilIdle();
@@ -6495,6 +6499,8 @@ TEST_P(PasswordManagerTest, HaveFormManagersReceivedDataDependsOnDriver) {
 
   FormData observed_form_data_other_frame = MakeSimpleFormData();
   MockPasswordManagerDriver other_driver;
+  ON_CALL(other_driver, GetLastCommittedOrigin)
+      .WillByDefault(ReturnRef(test_form_origin_));
   manager()->OnPasswordFormsParsed(&other_driver,
                                    {observed_form_data_other_frame});
 
@@ -7058,6 +7064,56 @@ TEST_P(PasswordManagerTest,
   ASSERT_TRUE(manager()->form_managers().empty());
 }
 
+TEST_P(PasswordManagerTest, FormManagerNotCreatedForOpaqueOrigin) {
+  const url::Origin opaque_origin;
+  ASSERT_TRUE(opaque_origin.opaque());
+  ON_CALL(driver_, GetLastCommittedOrigin)
+      .WillByDefault(ReturnRef(opaque_origin));
+
+  FormData form(MakeSimpleFormData());
+  manager()->OnPasswordFormsParsed(&driver_, {form});
+  manager()->OnPasswordFormsRendered(&driver_, {form});
+  // Check that a form manager was not created.
+  ASSERT_TRUE(manager()->form_managers().empty());
+
+  OnPasswordFormSubmitted(form);
+  // Check that a form manager was not created.
+  ASSERT_TRUE(manager()->form_managers().empty());
+}
+
+TEST_P(PasswordManagerTest,
+       FormManagerNotCreatedForOpaqueOriginOnServerPredictionsArrival) {
+  const url::Origin opaque_origin;
+  ASSERT_TRUE(opaque_origin.opaque());
+  ON_CALL(driver_, GetLastCommittedOrigin)
+      .WillByDefault(ReturnRef(opaque_origin));
+
+  FormData form(MakeSingleUsernameFormData());
+  EXPECT_CALL(driver_, PropagateFillDataOnParsingCompletion).Times(0);
+  manager()->ProcessAutofillPredictions(
+      &driver_, form,
+      CreateServerPredictions(form, {{0, FieldType::SINGLE_USERNAME}}));
+
+  // Check that a form manager was not created.
+  ASSERT_TRUE(manager()->form_managers().empty());
+}
+
+TEST_P(PasswordManagerTest,
+       FormManagerNotCreatedForOpaqueOriginOnModelPredictionsArrival) {
+  const url::Origin opaque_origin;
+  ASSERT_TRUE(opaque_origin.opaque());
+  ON_CALL(driver_, GetLastCommittedOrigin)
+      .WillByDefault(ReturnRef(opaque_origin));
+
+  FormData form(MakeFormDataWithOnlyNewPasswordField());
+  EXPECT_CALL(driver_, PropagateFillDataOnParsingCompletion).Times(0);
+  manager()->ProcessClassificationModelPredictions(
+      &driver_, form, {{form.fields()[0].global_id(), FieldType::PASSWORD}});
+
+  // Check that a form manager was not created.
+  ASSERT_TRUE(manager()->form_managers().empty());
+}
+
 TEST_P(PasswordManagerTest, DateLastFilledIsUpdated) {
   base::test::ScopedFeatureList feature_list{
       password_manager::features::kPasswordDateLastFilled};