diff --git a/gpu/ipc/service/gpu_channel.cc b/gpu/ipc/service/gpu_channel.cc
index f311ad50a1608..600f6e691935e 100644
--- a/gpu/ipc/service/gpu_channel.cc
+++ b/gpu/ipc/service/gpu_channel.cc
@@ -985,6 +985,19 @@ void GpuChannel::CreateCommandBuffer(
   std::unique_ptr<CommandBufferStub> stub;
   switch (init_params->attribs->which()) {
     case mojom::ContextCreationAttribs::Tag::kGles:
+      // Renderers must only request WebGL context types. Non-WebGL context
+      // types disable ANGLE's WebGL-compatibility validation gates and are
+      // reserved for the privileged GPU host (browser/viz). A compromised
+      // renderer requesting CONTEXT_TYPE_OPENGLES2 is attempting to bypass
+      // those gates. The responder defaults to kFatalFailure on early return.
+      if (!is_gpu_host_ &&
+          !IsWebGLContextType(init_params->attribs->get_gles()->context_type)) {
+        LOG(ERROR) << "ContextResult::kFatalFailure: non-gpu-host client "
+                      "requested non-WebGL GLES context type "
+                   << ContextTypeToLabel(
+                          init_params->attribs->get_gles()->context_type);
+        return;
+      }
       stub = std::make_unique<GLES2CommandBufferStub>(
           this, *init_params, command_buffer_id, sequence_id, stream_id,
           route_id);