diff --git a/third_party/angle/src/libANGLE/renderer/gl/BufferGL.cpp b/third_party/angle/src/libANGLE/renderer/gl/BufferGL.cpp
--- a/third_party/angle/src/libANGLE/renderer/gl/BufferGL.cpp
+++ b/third_party/angle/src/libANGLE/renderer/gl/BufferGL.cpp
@@ -299,6 +299,18 @@ angle::Result BufferGL::unmap(const gl::Context *context,
     return angle::Result::Continue;
 }

+void BufferGL::onDataChanged()
+{
+    // Bandaid: if the buffer data was changed on the GPU side (transform
+    // feedback, SSBO, pixel-pack, etc.) the CPU shadow copy is no longer
+    // authoritative. Drop it so that getIndexRange() falls back to mapping the
+    // real GPU buffer. The shadow only exists for WebGL ElementArray-typed
+    // buffers, which the WebGL frontend forbids from receiving GPU writes, but
+    // a compromised renderer can violate that in the command buffer.
+    mShadowCopy.reset();
+    BufferImpl::onDataChanged();
+}
+
 angle::Result BufferGL::getIndexRange(const gl::Context *context,
                                       gl::DrawElementsType type,
                                       size_t offset,
diff --git a/third_party/angle/src/libANGLE/renderer/gl/BufferGL.h b/third_party/angle/src/libANGLE/renderer/gl/BufferGL.h
--- a/third_party/angle/src/libANGLE/renderer/gl/BufferGL.h
+++ b/third_party/angle/src/libANGLE/renderer/gl/BufferGL.h
@@ -60,6 +60,8 @@ class BufferGL : public BufferImpl
                         GLboolean *result,
                         BufferFeedback *feedback) override;

+    void onDataChanged() override;
+
     angle::Result getIndexRange(const gl::Context *context,
                                 gl::DrawElementsType type,
                                 size_t offset,