diff --git a/third_party/blink/renderer/core/css/css_grouping_rule.cc b/third_party/blink/renderer/core/css/css_grouping_rule.cc
index 100825db5d69a..642e390214500 100644
--- a/third_party/blink/renderer/core/css/css_grouping_rule.cc
+++ b/third_party/blink/renderer/core/css/css_grouping_rule.cc
@@ -363,6 +363,10 @@ CSSRuleList* CSSGroupingRule::cssRules() const {
 void CSSGroupingRule::Reattach(StyleRuleBase* rule) {
   DCHECK(rule);
   group_rule_ = To<StyleRuleGroup>(rule);
+  // SECURITY: Crash safely if the wrapper list has been desynchronised from
+  // the backing child-rule list; otherwise wrappers may be reattached to a
+  // backing rule of a different concrete type (type confusion).
+  CHECK_EQ(child_rule_cssom_wrappers_.size(), group_rule_->ChildRules().size());
   for (unsigned i = 0; i < child_rule_cssom_wrappers_.size(); ++i) {
     if (child_rule_cssom_wrappers_[i]) {
       child_rule_cssom_wrappers_[i]->Reattach(
diff --git a/third_party/blink/renderer/core/css/css_style_rule.cc b/third_party/blink/renderer/core/css/css_style_rule.cc
index a28c568cc409b..f1f1ac93011cf 100644
--- a/third_party/blink/renderer/core/css/css_style_rule.cc
+++ b/third_party/blink/renderer/core/css/css_style_rule.cc
@@ -183,6 +183,11 @@ void CSSStyleRule::Reattach(StyleRuleBase* rule) {
   if (properties_cssom_wrapper_) {
     properties_cssom_wrapper_->Reattach(style_rule_->MutableProperties());
   }
+  // SECURITY: Crash safely if the wrapper list has been desynchronised from
+  // the backing child-rule list; otherwise wrappers may be reattached to a
+  // backing rule of a different concrete type (type confusion).
+  CHECK_EQ(child_rule_cssom_wrappers_.size(),
+           style_rule_->ChildRules() ? style_rule_->ChildRules()->size() : 0u);
   for (unsigned i = 0; i < child_rule_cssom_wrappers_.size(); ++i) {
     if (child_rule_cssom_wrappers_[i]) {
       child_rule_cssom_wrappers_[i]->Reattach(