diff --git a/gpu/command_buffer/client/gles2_implementation.cc b/gpu/command_buffer/client/gles2_implementation.cc
index 0005699cd4c18..d127b4f50fc8e 100644
--- a/gpu/command_buffer/client/gles2_implementation.cc
+++ b/gpu/command_buffer/client/gles2_implementation.cc
@@ -188,7 +188,12 @@ bool IsReadbackUsage(GLenum usage) {
 void UpdateProgramInfo(base::span<const uint8_t>& data,
                        ProgramInfoManager* manager,
                        ProgramInfoManager::ProgramInfoType type) {
-  DCHECK(data.size() > sizeof(cmds::GLES2ReturnProgramInfo));
+  // A compromised GPU process can send arbitrarily-sized OnReturnData
+  // payloads. Without this check, sizeof(GLES2ReturnProgramInfo)=8 is
+  // subtracted from data.size() in size_t arithmetic below, underflowing to
+  // ~SIZE_MAX and yielding a span that grants OOB heap reads. Match the
+  // hardening in WebGPUImplementation::OnGpuControlReturnData.
+  CHECK_GE(data.size(), sizeof(cmds::GLES2ReturnProgramInfo));
   const cmds::GLES2ReturnProgramInfo* return_program_info =
       reinterpret_cast<const cmds::GLES2ReturnProgramInfo*>(data.data());
   uint32_t program = return_program_info->program_client_id;
@@ -621,7 +626,10 @@ void GLES2Implementation::CallDeferredErrorCallbacks() {
 
 void GLES2Implementation::OnGpuControlReturnData(
     base::span<const uint8_t> data) {
-  DCHECK(data.size() > sizeof(cmds::GLES2ReturnDataHeader));
+  // A compromised GPU process can send a 0-3 byte OnReturnData payload over
+  // mojom::CommandBufferClient. Reading return_data_type below would be OOB.
+  // Match the hardening in WebGPUImplementation::OnGpuControlReturnData.
+  CHECK_GE(data.size(), sizeof(cmds::GLES2ReturnDataHeader));
   const cmds::GLES2ReturnDataHeader& gles2ReturnDataHeader =
       *reinterpret_cast<const cmds::GLES2ReturnDataHeader*>(data.data());