diff --git a/third_party/devtools-frontend/src/front_end/core/protocol_client/DevToolsCDPConnection.ts b/third_party/devtools-frontend/src/front_end/core/protocol_client/DevToolsCDPConnection.ts
index 8b5aa5dd30..2688d61cbc 100644
--- a/third_party/devtools-frontend/src/front_end/core/protocol_client/DevToolsCDPConnection.ts
+++ b/third_party/devtools-frontend/src/front_end/core/protocol_client/DevToolsCDPConnection.ts
@@ -131,11 +131,18 @@ export class DevToolsCDPConnection implements CDPConnection {
 
     if ('id' in messageObject && messageObject.id !== undefined) {  // just a response for some request
       const callback = this.#callbacks.get(messageObject.id);
-      this.#callbacks.delete(messageObject.id);
       if (!callback) {
         // Ignore messages with unknown IDs, we might see puppeteer proxied messages here.
         return;
       }
+      // A response must arrive on the same session the request was sent on.
+      // Without this check a renderer that holds a DevToolsSessionHost for one
+      // child session can resolve callbacks belonging to sibling sessions
+      // (cross-origin OOPIF / tab / browser) by guessing adjacent ids.
+      if ((callback.sessionId ?? '') !== (messageObject.sessionId ?? '')) {
+        return;
+      }
+      this.#callbacks.delete(messageObject.id);
 
       callback.resolve(messageObject);
       --this.#pendingResponsesCount;