diff --git a/ios/web/webui/crw_web_ui_scheme_handler.mm b/ios/web/webui/crw_web_ui_scheme_handler.mm
index 0000000000000..1111111111111 100644
--- a/ios/web/webui/crw_web_ui_scheme_handler.mm
+++ b/ios/web/webui/crw_web_ui_scheme_handler.mm
@@ -61,13 +61,19 @@ - (void)webView:(WKWebView*)webView
     return;
   }

+  // Anchor the same-origin check on the *last-committed* URL rather than
+  // `webView.URL`. `webView.URL` flips to the destination as soon as a
+  // provisional load starts (see crw_web_view_navigation_observer.mm:275-278),
+  // while the previous (potentially compromised) document is still live and
+  // can issue WKURLSchemeTasks.
+  NSURL* committedURL = webView.backForwardList.currentItem.URL;
   // The "Access-Control-Allow-Origin" header is required below to allow
   // requests from any WebUI page to load chrome://resources URLs. However,
   // requests between different WebUI pages are blocked directly instead.
-  if (!webView.URL ||
+  if (!committedURL ||
       (!URL.DomainIs(web::kWebUIResourcesHost) &&
        url::SchemeHostPort(URL) !=
-           url::SchemeHostPort(net::GURLWithNSURL(webView.URL)))) {
+           url::SchemeHostPort(net::GURLWithNSURL(committedURL)))) {
     NSError* error = [NSError
         errorWithDomain:NSURLErrorDomain
                    code:NSURLErrorNoPermissionsToReadFile