diff --git a/gpu/command_buffer/service/shared_image/ahardwarebuffer_image_backing_factory.cc b/gpu/command_buffer/service/shared_image/ahardwarebuffer_image_backing_factory.cc
--- a/gpu/command_buffer/service/shared_image/ahardwarebuffer_image_backing_factory.cc
+++ b/gpu/command_buffer/service/shared_image/ahardwarebuffer_image_backing_factory.cc
@@ -67,7 +67,12 @@
 namespace gpu {
 namespace {

-class OverlayImage final : public base::RefCounted<OverlayImage> {
+// OverlayImage is referenced from both the GPU main thread (via
+// AHardwareBufferImageBacking::overlay_image_, released under
+// SharedImageManager::lock_ during backing destruction) and CompositorGpuThread
+// (via ScopedHardwareBufferFenceSyncImpl held in GLSurfaceEGLSurfaceControl
+// frame resources). It must use a thread-safe (atomic) refcount.
+class OverlayImage final : public base::RefCountedThreadSafe<OverlayImage> {
  public:
   explicit OverlayImage(AHardwareBuffer* buffer)
       : handle_(base::android::ScopedHardwareBufferHandle::Create(buffer)) {}
@@ -86,7 +91,7 @@ class OverlayImage final : public base::RefCounted<OverlayImage> {
   }

  private:
-  friend class base::RefCounted<OverlayImage>;
+  friend class base::RefCountedThreadSafe<OverlayImage>;

   class ScopedHardwareBufferFenceSyncImpl
       : public base::android::ScopedHardwareBufferFenceSync {