diff --git a/call/call.cc b/call/call.cc
index df8786c886..8204950381 100644
--- a/call/call.cc
+++ b/call/call.cc
@@ -1230,7 +1230,16 @@ void Call::OnUpdateSyncGroup(webrtc::AudioReceiveStreamInterface& stream,
   RTC_DCHECK_RUN_ON(worker_thread_);
   webrtc::AudioReceiveStreamImpl& receive_stream =
       static_cast<webrtc::AudioReceiveStreamImpl&>(stream);
+  // Capture the previous sync_group before mutation. Any VideoReceiveStream2
+  // currently synced to `receive_stream` under the *old* group must have its
+  // RtpStreamsSynchronizer::syncable_audio_ re-evaluated, otherwise it is left
+  // pointing at `receive_stream` and becomes a dangling Syncable* when the
+  // stream is later destroyed (UAF on a virtual call).
+  std::string old_sync_group(receive_stream.sync_group());
   receive_stream.SetSyncGroup(sync_group);
+  if (old_sync_group != sync_group) {
+    ConfigureSync(old_sync_group);
+  }
   ConfigureSync(sync_group);
 }