diff --git a/ui/events/devices/x11/device_data_manager_x11.cc b/ui/events/devices/x11/device_data_manager_x11.cc
index 0447e08d6c31a..013d45d0ce3a4 100644
--- a/ui/events/devices/x11/device_data_manager_x11.cc
+++ b/ui/events/devices/x11/device_data_manager_x11.cc
@@ -287,7 +287,9 @@ void DeviceDataManagerX11::GetEventRawData(const x11::Event& x11_event,
   }
   data->clear();
   auto valuators_iter = xiev->axisvalues.begin();
-  for (int i = 0; i <= valuator_count_[sourceid]; ++i) {
+  const int mask_bits = static_cast<int>(xiev->valuator_mask.size() * 32);
+  for (int i = 0; i <= valuator_count_[sourceid] && i < mask_bits; ++i) {
+    CHECK(valuators_iter <= xiev->axisvalues.end());
     if (IsXinputMaskSet(xiev->valuator_mask.data(), i)) {
       int type = data_type_lookup_[sourceid][i];
       if (type != DT_LAST_ENTRY) {
@@ -335,8 +337,9 @@ bool DeviceDataManagerX11::GetEventData(const x11::Event& x11_event,
   }
 
   int val_index = valuator_lookup_[sourceid][type].number;
+  const int mask_bits = static_cast<int>(xiev->valuator_mask.size() * 32);
   int slot = 0;
-  if (val_index >= 0) {
+  if (val_index >= 0 && val_index < mask_bits) {
     if (IsXinputMaskSet(xiev->valuator_mask.data(), val_index)) {
       auto valuators_iter = xiev->axisvalues.begin();
       while (val_index--) {
@@ -538,7 +541,9 @@ void DeviceDataManagerX11::GetScrollClassOffsets(const x11::Event& x11_event,
   const int horizontal_number = info->horizontal.number;
   const int vertical_number = info->vertical.number;
 
-  for (int i = 0; i <= valuator_count_[sourceid]; ++i) {
+  const int mask_bits = static_cast<int>(xiev->valuator_mask.size() * 32);
+  for (int i = 0; i <= valuator_count_[sourceid] && i < mask_bits; ++i) {
+    CHECK(valuators_iter <= xiev->axisvalues.end());
     if (!IsXinputMaskSet(xiev->valuator_mask.data(), i))
       continue;
     auto valuator = Fp3232ToDouble(*valuators_iter);