diff --git a/third_party/blink/renderer/platform/peerconnection/rtc_video_encoder.cc b/third_party/blink/renderer/platform/peerconnection/rtc_video_encoder.cc
index 68ea321891147..bd540b92ac2f9 100644
--- a/third_party/blink/renderer/platform/peerconnection/rtc_video_encoder.cc
+++ b/third_party/blink/renderer/platform/peerconnection/rtc_video_encoder.cc
@@ -2182,6 +2182,12 @@ RTCVideoEncoder::Impl::CreateNV12SharedImageFrame(
   const size_t dst_uv_stride = mapping->Stride(1);
   const size_t width = frame->visible_rect().width();
   const size_t height = frame->visible_rect().height();
+  // `i420_buffer` was materialised at `frame_buffer`'s natural_size, which can
+  // be smaller than `frame->visible_rect()` for web-constructed VideoFrames.
+  // Copying visible_rect-sized rows from a natural_size-sized source over-reads
+  // the heap.
+  CHECK_LE(width, base::checked_cast<size_t>(i420_buffer->width()));
+  CHECK_LE(height, base::checked_cast<size_t>(i420_buffer->height()));
   if (libyuv::I420ToNV12(i420_buffer->DataY(), i420_buffer->StrideY(),
                          i420_buffer->DataU(), i420_buffer->StrideU(),
                          i420_buffer->DataV(), i420_buffer->StrideV(), dst_y,