diff --git a/android_webview/browser/aw_print_manager.cc b/android_webview/browser/aw_print_manager.cc
index 0000000..0000000 100644
--- a/android_webview/browser/aw_print_manager.cc
+++ b/android_webview/browser/aw_print_manager.cc
@@ -162,14 +162,21 @@ void AwPrintManager::DidPrintDocument(
   if (number_pages() > printing::kMaxPageCount) {
     PdfWritingDone(0);
     std::move(callback).Run(false);
     return;
   }

+  // Consume `fd_` on the UI thread *before* posting so that a compromised
+  // renderer pipelining multiple DidPrintDocument calls cannot capture the
+  // same borrowed descriptor into multiple concurrent workers (which would
+  // otherwise write() to a recycled fd after the first reply drops the Java
+  // ParcelFileDescriptor reference).
+  const int fd = std::exchange(fd_, base::kInvalidFd);
   base::ThreadPool::CreateTaskRunner(
       {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
        base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN})
       ->PostTaskAndReplyWithResult(
-          FROM_HERE, base::BindOnce(&SaveDataToFd, fd_, number_pages(), data),
+          FROM_HERE, base::BindOnce(&SaveDataToFd, fd, number_pages(), data),
           base::BindOnce(&AwPrintManager::OnDidPrintDocumentWritingDone,
                          weak_ptr_factory_.GetWeakPtr(), std::move(callback)));
 }