diff --git a/device/bluetooth/socket.cc b/device/bluetooth/socket.cc
index 18f3eb209f5b1..bae5788110184 100644
--- a/device/bluetooth/socket.cc
+++ b/device/bluetooth/socket.cc
@@ -168,9 +168,16 @@ void Socket::SendMore() {
     return;
   }
 
-  std::string_view chars = base::as_string_view(pending_read_buffer);
-  bluetooth_socket_->Send(base::MakeRefCounted<net::WrappedIOBuffer>(chars),
-                          chars.size(),
+  // BluetoothSocket::Send() implementations (BluetoothSocketNet,
+  // BluetoothSocketAndroid) post the buffer to a separate socket thread.
+  // |pending_read_buffer| points into the data-pipe ring buffer, which is
+  // unmapped when |send_stream_| is reset (e.g. in ~Socket()). A
+  // WrappedIOBuffer over that span would dangle on the socket thread, so copy
+  // the bytes into an owned IOBuffer instead.
+  auto io_buffer =
+      base::MakeRefCounted<net::IOBufferWithSize>(pending_read_buffer.size());
+  io_buffer->span().copy_from(pending_read_buffer);
+  bluetooth_socket_->Send(std::move(io_buffer), pending_read_buffer.size(),
                           base::BindOnce(&Socket::OnBluetoothSocketSend,
                                          weak_ptr_factory_.GetWeakPtr()),
                           base::BindOnce(&Socket::OnBluetoothSocketSendError,