diff --git a/chromecast/starboard/media/media/drm_util.cc b/chromecast/starboard/media/media/drm_util.cc
index 549fb421e68d8..a3e20033d2a8f 100644
--- a/chromecast/starboard/media/media/drm_util.cc
+++ b/chromecast/starboard/media/media/drm_util.cc
@@ -9,6 +9,7 @@
 #include "base/check.h"
 #include "base/containers/span.h"
 #include "base/logging.h"
+#include "base/numerics/checked_math.h"
 
 namespace chromecast {
 namespace media {
@@ -97,8 +98,12 @@ DrmInfoWrapper DrmInfoWrapper::Create(const CastDecoderBuffer& buffer) {
   subsample_mappings->reserve(decrypt_config->subsamples().size());
   for (const SubsampleEntry& subsample : decrypt_config->subsamples()) {
     StarboardDrmSubSampleMapping mapping;
-    mapping.clear_byte_count = subsample.clear_bytes;
-    mapping.encrypted_byte_count = subsample.cypher_bytes;
+    // SECURITY: subsample byte counts originate from an untrusted renderer via
+    // mojom::DemuxerStream::Read with no value validation. CHECK-crash rather
+    // than silently wrap negative when narrowing uint32 -> int32.
+    mapping.clear_byte_count = base::checked_cast<int32_t>(subsample.clear_bytes);
+    mapping.encrypted_byte_count =
+        base::checked_cast<int32_t>(subsample.cypher_bytes);
     subsample_mappings->push_back(std::move(mapping));
   }
 
@@ -185,8 +190,12 @@ DrmInfoWrapper DrmInfoWrapper::Create(const ::media::DecoderBuffer& buffer) {
   subsample_mappings->reserve(decrypt_config.subsamples().size());
   for (const ::media::SubsampleEntry& subsample : decrypt_config.subsamples()) {
     StarboardDrmSubSampleMapping mapping;
-    mapping.clear_byte_count = subsample.clear_bytes;
-    mapping.encrypted_byte_count = subsample.cypher_bytes;
+    // SECURITY: subsample byte counts originate from an untrusted renderer via
+    // mojom::DemuxerStream::Read with no value validation. CHECK-crash rather
+    // than silently wrap negative when narrowing uint32 -> int32.
+    mapping.clear_byte_count = base::checked_cast<int32_t>(subsample.clear_bytes);
+    mapping.encrypted_byte_count =
+        base::checked_cast<int32_t>(subsample.cypher_bytes);
     subsample_mappings->push_back(std::move(mapping));
   }