diff --git a/media/mojo/services/mojo_decryptor_service.cc b/media/mojo/services/mojo_decryptor_service.cc
index 0e7cc59fffb0c..252bd638ecbc0 100644
--- a/media/mojo/services/mojo_decryptor_service.cc
+++ b/media/mojo/services/mojo_decryptor_service.cc
@@ -207,8 +207,16 @@ void MojoDecryptorService::DeinitializeDecoder(StreamType stream_type) {
     return;
   }
 
-  DCHECK(!reader->HasPendingReads())
-      << "The decoder should be fully flushed before deinitialized.";
+  // A well-behaved client never deinitializes the decoder while a
+  // DecryptAndDecode read is still pending on the DataPipe. A compromised
+  // renderer can stall the DataPipe to force this state and then fire
+  // DecryptAndDecode* into a deinitialized library CDM, so reject it.
+  if (reader->HasPendingReads()) {
+    CHECK(mojo::IsInMessageDispatch());
+    mojo::ReportBadMessage(
+        "DeinitializeDecoder with pending DecryptAndDecode reads");
+    return;
+  }
 
   decryptor_->DeinitializeDecoder(stream_type);
 }