diff --git a/chromecast/media/cma/backend/mixer/filter_group_unittest.cc b/chromecast/media/cma/backend/mixer/filter_group_unittest.cc
index 53edd76911457..4c8fde0664966 100644
--- a/chromecast/media/cma/backend/mixer/filter_group_unittest.cc
+++ b/chromecast/media/cma/backend/mixer/filter_group_unittest.cc
@@ -247,5 +247,28 @@ TEST_F(FilterGroupTest, ReportsOutputChannels) {
   EXPECT_EQ(4, filter_group_->GetOutputChannelCount());
 }
 
+// POC: Negative channel_selection causes heap OOB read in
+// MixerInput::RenderInterleaved.
+//
+// On a real device, OutputStreamParams.channel_selection (sint32) arrives over
+// the unauthenticated mixer-service abstract UDS / 127.0.0.1 TCP socket and is
+// stored verbatim into MixerInputConnection::playout_channel_, which is what
+// MixerInput::Source::playout_channel() returns. Setting it directly on the
+// MockMixerSource here reproduces exactly what the mixer thread sees after
+// receiving such a message.
+//
+// MixerInput::RenderInterleaved (mixer_input.cc:273) only checks
+//   (playout_channel_ != kChannelAll && playout_channel_ < num_channels_)
+// with no >=0 lower bound, so any value <= -2 falls through to the loop and
+// computes data[f * num_channels_ + playout_channel_] at negative indices into
+// the AlignedAlloc-backed |interleaved_| heap buffer.
+//
+// Under ASAN this test triggers a heap-buffer-overflow READ.
+TEST_F(FilterGroupTest, NegativePlayoutChannelOOBRead) {
+  source_.set_playout_channel(-64);
+  MakeFilterGroup();
+  filter_group_->MixAndFilter(kInputFrames, RenderingDelay());
+}
+
 }  // namespace media
 }  // namespace chromecast