diff --git a/third_party/angle/src/libANGLE/renderer/vulkan/ContextVk.cpp b/third_party/angle/src/libANGLE/renderer/vulkan/ContextVk.cpp
index 1111111111..3333333333 100644
--- a/third_party/angle/src/libANGLE/renderer/vulkan/ContextVk.cpp
+++ b/third_party/angle/src/libANGLE/renderer/vulkan/ContextVk.cpp
@@ -7717,8 +7717,15 @@ void ContextVk::finalizeImageLayout(vk::ImageHelper *image, UniqueSerial imageSi
         // to use the image while the barrier-to-foreign is cached in the context, it will attempt
         // to acquire the image from foreign while the release is still cached.  A submission is
         // made to finalize the queue family ownership transfer back to foreign.
-        (void)flushAndSubmitCommands(nullptr, nullptr, QueueSubmitReason::ForeignImageRelease);
-        ASSERT(!hasForeignImagesToTransition());
+        const angle::Result result =
+            flushAndSubmitCommands(nullptr, nullptr, QueueSubmitReason::ForeignImageRelease);
+        // Bandaid: if the flush failed (e.g. VK_ERROR_OUT_OF_DEVICE_MEMORY before
+        // prepareToSubmitAllCommands ran), |mForeignImagesInUse| still holds raw
+        // ImageHelper* values that the caller is about to free.  Drop them now so
+        // that a later submit on this (already lost) context cannot dereference
+        // freed memory in releaseToForeign().
+        ANGLE_UNUSED_VARIABLE(result);
+        forgetAllForeignImages();
     }
 }

diff --git a/third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.h b/third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.h
index 4444444444..5555555555 100644
--- a/third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.h
+++ b/third_party/angle/src/libANGLE/renderer/vulkan/vk_helpers.h
@@ -92,6 +92,13 @@ class Context : public ErrorContext
     void onForeignImageUse(ImageHelper *image);
     void finalizeForeignImage(ImageHelper *image);
     void finalizeAllForeignImages();
+    // Bandaid for foreign-image UAF: drop all raw ImageHelper* tracking without
+    // dereferencing them. Called when flushAndSubmitCommands() fails before
+    // reaching prepareToSubmitAllCommands().
+    void forgetAllForeignImages()
+    {
+        mForeignImagesInUse.clear();
+    }

   protected:
     bool hasForeignImagesToTransition() const