diff --git a/dom/clients/manager/moz.build b/dom/clients/manager/moz.build
index 84b494c7fc7..75e9707455d 100644
--- a/dom/clients/manager/moz.build
+++ b/dom/clients/manager/moz.build
@@ -13,6 +13,7 @@ EXPORTS.mozilla.dom += [
     "ClientManagerService.h",
     "ClientOpenWindowUtils.h",
     "ClientOpPromise.h",
+    "ClientPrincipalUtils.h",
     "ClientSource.h",
     "ClientState.h",
     "ClientThing.h",
diff --git a/dom/serviceworkers/ServiceWorkerManager.cpp b/dom/serviceworkers/ServiceWorkerManager.cpp
index 7073a4ae4c0..9d78131fddb 100644
--- a/dom/serviceworkers/ServiceWorkerManager.cpp
+++ b/dom/serviceworkers/ServiceWorkerManager.cpp
@@ -39,6 +39,7 @@
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/ClientHandle.h"
 #include "mozilla/dom/ClientManager.h"
+#include "mozilla/dom/ClientPrincipalUtils.h"
 #include "mozilla/dom/ClientSource.h"
 #include "mozilla/dom/ConsoleUtils.h"
 #include "mozilla/dom/ContentParent.h"
@@ -2496,6 +2497,18 @@ nsresult ServiceWorkerManager::GetClientRegistration(
     return NS_ERROR_NOT_AVAILABLE;
   }
 
+  // Defense in depth: mControlledClients is keyed on the client id alone, so
+  // verify the client and the registration controlling it are same-origin
+  // before handing the registration back to a fetch event dispatch.  Every
+  // legitimately controlled client already satisfies this, since
+  // ClientSource::SetController() and ClientHandle::Control() both assert it.
+  if (NS_WARN_IF(!ClientMatchPrincipalInfo(aClientInfo.PrincipalInfo(),
+                                           data->mRegistrationInfo->GetActive()
+                                               ->Descriptor()
+                                               .PrincipalInfo()))) {
+    return NS_ERROR_NOT_AVAILABLE;
+  }
+
   RefPtr<ServiceWorkerRegistrationInfo> ref = data->mRegistrationInfo;
   ref.forget(aRegistrationInfo);
   return NS_OK;