diff --git a/extensions/browser/api/declarative_net_request/file_backed_ruleset_source.cc b/extensions/browser/api/declarative_net_request/file_backed_ruleset_source.cc
index de360cc95164f..1d3ded2cc2e53 100644
--- a/extensions/browser/api/declarative_net_request/file_backed_ruleset_source.cc
+++ b/extensions/browser/api/declarative_net_request/file_backed_ruleset_source.cc
@@ -53,6 +53,13 @@ constexpr const char kDynamicRulesetDirectory[] = "DNR Extension Rules";
 constexpr const char kDynamicRulesJSONFilename[] = "rules.json";
 constexpr const char kDynamicIndexedRulesFilename[] = "rules.fbs";
 
+// flatbuffers::FlatBufferBuilder tracks its serialized size in a uint32 and
+// uses int32 vtable offsets, with only a debug-only assert guarding the limit
+// (vector_downward.h:151). The indexed flatbuffer is roughly the same size as
+// the source JSON, so cap the JSON well below 2 GiB to keep the builder safely
+// within range. 512 MiB still allows ~330 000 rules of ~1.5 KiB each.
+constexpr size_t kMaxRulesetJsonBytes = 512u * 1024 * 1024;
+
 // Helper to retrieve the filename for the given |file_path|.
 std::string GetFilename(const base::FilePath& file_path) {
   return file_path.BaseName().AsUTF8Unsafe();
@@ -385,7 +392,11 @@ void FileBackedRulesetSource::IndexAndPersistJSONRuleset(
   }
 
   std::string json_contents;
-  if (!base::ReadFileToString(json_path_, &json_contents)) {
+  // FlatBufferBuilder uses 32-bit sizes/offsets and has only a debug-build
+  // assert guarding the 2 GiB limit; cap the on-disk ruleset so the indexed
+  // flatbuffer can never approach that limit.
+  if (!base::ReadFileToStringWithMaxSize(json_path_, &json_contents,
+                                         kMaxRulesetJsonBytes)) {
     std::move(callback).Run(IndexAndPersistJSONRulesetResult::CreateErrorResult(
         GetErrorWithFilename(json_path_, kFileReadError)));
     return;
@@ -405,7 +416,8 @@ ReadJSONRulesResult FileBackedRulesetSource::ReadJSONRulesUnsafe() const {
   }
 
   std::string json_contents;
-  if (!base::ReadFileToString(json_path_, &json_contents)) {
+  if (!base::ReadFileToStringWithMaxSize(json_path_, &json_contents,
+                                         kMaxRulesetJsonBytes)) {
     return ReadJSONRulesResult::CreateErrorResult(Status::kFileReadError,
                                                   kFileReadError);
   }