diff --git a/rtc_base/ref_counter.h b/rtc_base/ref_counter.h
index af253914b43..e2fd169e9d8 100644
--- a/rtc_base/ref_counter.h
+++ b/rtc_base/ref_counter.h
@@ -11,8 +11,10 @@
 #define RTC_BASE_REF_COUNTER_H_
 
 #include <atomic>
+#include <limits>
 
 #include "api/ref_count.h"
+#include "rtc_base/checks.h"
 
 namespace webrtc {
 namespace webrtc_impl {
@@ -26,7 +28,12 @@ class RefCounter {
     // Relaxed memory order: The current thread is allowed to act on the
     // resource protected by the reference counter both before and after the
     // atomic op, so this function doesn't prevent memory access reordering.
-    ref_count_.fetch_add(1, std::memory_order_relaxed);
+    int old_count = ref_count_.fetch_add(1, std::memory_order_relaxed);
+    // An attacker who can drive the 32-bit counter past INT_MAX can wrap it
+    // back to zero and induce a use-after-free while live holders remain.
+    // Chromium's base::RefCountedThreadSafe guards against this; mirror that
+    // protection here.
+    RTC_CHECK_LT(old_count, std::numeric_limits<int>::max());
   }
 
   // Returns kDroppedLastRef if this call dropped the last reference; the caller