diff --git a/gpu/command_buffer/service/indexed_buffer_binding_host.cc b/gpu/command_buffer/service/indexed_buffer_binding_host.cc
index 4d6f643d1c346..ed94c43d09c9e 100644
--- a/gpu/command_buffer/service/indexed_buffer_binding_host.cc
+++ b/gpu/command_buffer/service/indexed_buffer_binding_host.cc
@@ -4,6 +4,7 @@
 
 #include "gpu/command_buffer/service/indexed_buffer_binding_host.h"
 
+#include "base/numerics/checked_math.h"
 #include "gpu/command_buffer/service/buffer_manager.h"
 
 namespace gpu {
@@ -153,7 +154,9 @@ void IndexedBufferBindingHost::DoAdjustedBindBufferRange(
     glBindBufferBase(target, index, service_id);
     return;
   }
-  if (offset + size > full_buffer_size) {
+  GLsizeiptr range_end;
+  if (!base::CheckAdd(offset, size).AssignIfValid(&range_end) ||
+      range_end > full_buffer_size) {
     adjusted_size = full_buffer_size - offset;
     // size needs to be a multiple of 4.
     adjusted_size = adjusted_size & ~3;
@@ -278,10 +281,17 @@ GLsizeiptr IndexedBufferBindingHost::GetEffectiveBufferSize(
   switch (binding.type) {
     case IndexedBufferBindingType::kBindBufferBase:
       return full_buffer_size;
-    case IndexedBufferBindingType::kBindBufferRange:
-      if (binding.offset + binding.size > full_buffer_size)
+    case IndexedBufferBindingType::kBindBufferRange: {
+      if (binding.offset >= full_buffer_size) {
+        return 0;
+      }
+      GLsizeiptr end;
+      if (!base::CheckAdd(binding.offset, binding.size).AssignIfValid(&end) ||
+          end > full_buffer_size) {
         return full_buffer_size - binding.offset;
+      }
       return binding.size;
+    }
     case IndexedBufferBindingType::kBindBufferNone:
       return 0;
   }