diff --git a/services/network/public/cpp/sri_message_signatures.cc b/services/network/public/cpp/sri_message_signatures.cc
index 8445b1f07d72b..f8b6a1407781d 100644
--- a/services/network/public/cpp/sri_message_signatures.cc
+++ b/services/network/public/cpp/sri_message_signatures.cc
@@ -802,10 +802,20 @@ bool ValidateSRIMessageSignaturesOverHeaders(
       return false;
     }
 
-    // Generate the signature base:
-    std::string signature_base =
-        ConstructSignatureBase(message_signature, url_request, headers)
-            .value_or("");
+    // Generate the signature base. RFC 9421 sec. 2.5 requires verifiers to
+    // FAIL when the signature base cannot be constructed (e.g. a declared
+    // header component is absent from the message). A successfully constructed
+    // base for this profile is never empty: it always contains at least the
+    // serialized signature params (line ~769). So nullopt -> fail validation.
+    std::optional<std::string> maybe_signature_base =
+        ConstructSignatureBase(message_signature, url_request, headers);
+    if (!maybe_signature_base.has_value()) {
+      AddIssueFromErrorEnum(
+          mojom::SRIMessageSignatureError::kValidationFailedSignatureMismatch,
+          message_signatures->issues);
+      return false;
+    }
+    std::string signature_base = std::move(maybe_signature_base).value();
 
     // Decode the public key, and validate that both the public key and the
     // message's signature are the correct length for Ed25519 (32 and 64 bits,