diff --git a/chromecast/media/cma/pipeline/av_pipeline_impl.cc b/chromecast/media/cma/pipeline/av_pipeline_impl.cc
--- a/chromecast/media/cma/pipeline/av_pipeline_impl.cc
+++ b/chromecast/media/cma/pipeline/av_pipeline_impl.cc
@@ -72,11 +72,18 @@ bool AvPipelineImpl::StartPlayingFrom(
   // Reset the pipeline statistics.
   previous_stats_ = ::media::PipelineStatistics();

   if (state_ == kError) {
     LOG(INFO) << __FUNCTION__ << " called while in error state";
     return false;
   }
-  DCHECK_EQ(state_, kFlushed);
+  // A second StartPlayingFrom without an intervening Flush() can be triggered
+  // by a compromised renderer over media::mojom::Renderer. Clearing
+  // |pushed_buffer_| below while the backend still holds a raw pointer to it
+  // under an outstanding kBufferPending contract is a use-after-free.
+  if (state_ != kFlushed) {
+    LOG(ERROR) << __FUNCTION__ << " called in unexpected state " << state_;
+    return false;
+  }

   // Buffering related initialization.
   DCHECK(frame_provider_);