diff --git a/third_party/blink/renderer/core/html/forms/html_selected_content_element.cc b/third_party/blink/renderer/core/html/forms/html_selected_content_element.cc
index 90ba80839b9f5..5f141a364ff53 100644
--- a/third_party/blink/renderer/core/html/forms/html_selected_content_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_selected_content_element.cc
@@ -21,6 +21,14 @@ void HTMLSelectedContentElement::CloneContentsFromOptionElement(
     return;
   }
 
+  // Do not synchronously mutate the DOM while a state-preserving atomic move
+  // is in progress. Doing so can detach the moveBefore reference child and
+  // leave the moved subtree orphaned with a live ContentFrame() / attached
+  // layout (see html_frame_owner_element.cc SECURITY_CHECK).
+  if (GetDocument().StatePreservingAtomicMoveInProgress()) {
+    return;
+  }
+
   if (RuntimeEnabledFeatures::SelectedcontentSpecEnabled()) {
     DCHECK(!ScriptForbiddenScope::IsScriptForbidden());
 #if DCHECK_IS_ON()