diff --git a/components/gwp_asan/crash_handler/crash_analyzer.cc b/components/gwp_asan/crash_handler/crash_analyzer.cc
index 56af968b5226c..01fba1e594ade 100644
--- a/components/gwp_asan/crash_handler/crash_analyzer.cc
+++ b/components/gwp_asan/crash_handler/crash_analyzer.cc
@@ -385,6 +385,20 @@ bool CrashAnalyzer::AnalyzeLightweightDetectorCrash(
   proto->set_allocation_size(metadata.alloc_size);
   if (metadata.dealloc.tid != base::kInvalidThreadId ||
       metadata.dealloc.trace_len) {
+    // SECURITY: |deallocation_stack_trace| is only
+    // LightweightDetectorState::kMaxPackedTraceLength (90) bytes, but
+    // ReadAllocationInfo() bounds trace_len against
+    // AllocatorState::kMaxPackedTraceLength (400). |metadata| is copied
+    // verbatim from the analysed process / intermediate dump and is therefore
+    // attacker-controlled, so an out-of-range trace_len would cause an OOB
+    // heap read inside Unpack().
+    if (metadata.dealloc.trace_len >
+        LightweightDetectorState::kMaxPackedTraceLength) {
+      DLOG(ERROR) << "LUD stack trace length is corrupted: "
+                  << metadata.dealloc.trace_len;
+      metadata.dealloc.trace_len = 0;
+      metadata.dealloc.trace_collected = false;
+    }
     ReadAllocationInfo(metadata.deallocation_stack_trace,
                        /* stack_trace_offset = */ 0, metadata.dealloc,
                        proto->mutable_deallocation());