diff --git a/ios/web/annotations/annotations_java_script_feature.mm b/ios/web/annotations/annotations_java_script_feature.mm
index a2938dfae5f53..109da0917aae3 100644
--- a/ios/web/annotations/annotations_java_script_feature.mm
+++ b/ios/web/annotations/annotations_java_script_feature.mm
@@ -20,6 +20,11 @@
 namespace {
 const char kScriptName[] = "text_main";
 const char kScriptHandlerName[] = "annotations";
+// Upper bound on web-supplied strings forwarded to the in-process text
+// classifier. Mirrors the (previously dead) kMaxAnnotationsTextLength cap in
+// AnnotationsTextManagerImpl. https://crbug.com/1492506
+constexpr size_t kMaxExtractedTextLength = 65535;
+constexpr size_t kMaxMetadataStringLength = 256;
 }  // namespace
 
 namespace web {
@@ -135,6 +140,18 @@ void AnnotationsJavaScriptFeature::ScriptMessageReceived(
     if (!text || !seq_id || !metadata) {
       return;
     }
+    // Enforce the size cap that ExtractText()'s `maximum_text_length`
+    // parameter was meant to provide but never wired through to JS.
+    if (text->size() > kMaxExtractedTextLength) {
+      return;
+    }
+    const std::string* html_lang = metadata->FindString("htmlLang");
+    const std::string* http_lang = metadata->FindString("httpContentLanguage");
+    if ((html_lang && html_lang->size() > kMaxMetadataStringLength) ||
+        (http_lang && http_lang->size() > kMaxMetadataStringLength)) {
+      // Page-controlled locale strings drive tokenizer/model selection.
+      return;
+    }
     manager->OnTextExtracted(web_state, *text, static_cast<int>(seq_id.value()),
                              *metadata);
   } else if (*command == "annotations.decoratingComplete") {