diff --git a/extensions/browser/api/web_request/web_request_proxying_url_loader_factory.cc b/extensions/browser/api/web_request/web_request_proxying_url_loader_factory.cc
index b9f35dd966366..6b44e4321463a 100644
--- a/extensions/browser/api/web_request/web_request_proxying_url_loader_factory.cc
+++ b/extensions/browser/api/web_request/web_request_proxying_url_loader_factory.cc
@@ -1571,6 +1571,16 @@ void WebRequestProxyingURLLoaderFactory::CreateLoaderAndStart(
     // correlation against any auth events received by the browser.
     // Requests with a request ID of 0 therefore do not support
     // dispatching |WebRequest.onAuthRequired| events.
+    //
+    // |request_id| is supplied by the renderer. Reject duplicates so a
+    // compromised renderer cannot alias two InProgressRequests via this map
+    // (which would let onAuthRequired / TrustedHeaderClient events for one
+    // URL be dispatched against another URL's WebRequestInfo).
+    if (network_request_id_to_web_request_id_.contains(request_id)) {
+      proxy_receivers_.ReportBadMessage(
+          "WebRequestProxyingURLLoaderFactory: duplicate request_id");
+      return;
+    }
     proxies_->AssociateProxyWithRequestId(
         this, content::GlobalRequestID(
                   content::ToOriginatingProcessIdUnsafe(render_process_id_),