diff --git a/gin/public/gin_embedders.h b/gin/public/gin_embedders.h
index 528656cbb44b1..faf8cf5789269 100644
--- a/gin/public/gin_embedders.h
+++ b/gin/public/gin_embedders.h
@@ -68,8 +68,19 @@ enum ExternalPointerTypeTag : uint16_t {
   kFXJSEFunctionDescriptorTag,
   kFXJSEClassDescriptorTag,
   kV8IsolateTag,
+  // ----- Add new embedder tags above this line. -----
+  kNumExternalPointerTypeTags,
 };
 
+// v8/src/inspector hard-codes v8::ExternalPointerTypeTag values 36/37/38 for
+// its own use (V8SerializationDuplicateTracker / TaskInfo / V8Console), and 39
+// is reserved for kFastApiExternalTypeTag. If the gin enum grows into that
+// range the V8-sandbox per-type tag check is silently defeated and an
+// in-sandbox attacker can confuse the colliding C++ types.
+static_assert(kNumExternalPointerTypeTags <= 36,
+              "gin::ExternalPointerTypeTag collides with v8_inspector tags; "
+              "bump V8_EXTERNAL_POINTER_TAG_COUNT and the v8_inspector tags");
+
 }  // namespace gin
 
 #endif  // GIN_PUBLIC_GIN_EMBEDDERS_H_
diff --git a/v8/src/inspector/v8-console.cc b/v8/src/inspector/v8-console.cc
index 37fdf476c1d..50209b65a85 100644
--- a/v8/src/inspector/v8-console.cc
+++ b/v8/src/inspector/v8-console.cc
@@ -516,9 +516,9 @@ void V8Console::createTask(const v8::FunctionCallbackInfo<v8::Value>& info) {
 }
 
 namespace {
-// This tag value has been picked arbitrarily between 0 and
-// V8_EXTERNAL_POINTER_TAG_COUNT.
-constexpr v8::ExternalPointerTypeTag kTaskInfoTag = 9;
+// See the comment on V8Console::kV8ConsoleTag for why this is allocated from
+// the top of the embedder-reserved range.
+constexpr v8::ExternalPointerTypeTag kTaskInfoTag = 37;
 }  // namespace
 
 void V8Console::runTask(const v8::FunctionCallbackInfo<v8::Value>& info) {
diff --git a/v8/src/inspector/v8-console.h b/v8/src/inspector/v8-console.h
index 51733274e89..419a90f4fe2 100644
--- a/v8/src/inspector/v8-console.h
+++ b/v8/src/inspector/v8-console.h
@@ -199,9 +199,14 @@ class V8Console : public v8::debug::ConsoleDelegate {
   void queryObjectsCallback(const v8::FunctionCallbackInfo<v8::Value>& info,
                             int sessionId);
 
-  // This tag value has been picked arbitrarily between 0 and
-  // V8_EXTERNAL_POINTER_TAG_COUNT.
-  constexpr static v8::ExternalPointerTypeTag kV8ConsoleTag = 10;
+  // V8-inspector-internal v8::External type tags. These live in the same
+  // numeric space as the embedder's tags (see V8_EXTERNAL_POINTER_TAG_COUNT),
+  // so they MUST NOT collide with any value the embedder picks. They are
+  // therefore allocated from the *top* of the range, immediately below the
+  // value reserved for kFastApiExternalTypeTag (= 39).
+  // TODO: give v8/src/inspector its own ExternalPointerTag range outside the
+  // embedder-reserved [kFirstExternalTypeTag, kLastExternalTypeTag] window.
+  constexpr static v8::ExternalPointerTypeTag kV8ConsoleTag = 38;
 
   // Lazily creates m_taskInfoKey and returns a local handle to it. We can't
   // initialize m_taskInfoKey in the constructor as it would be part of
diff --git a/v8/src/inspector/v8-serialization-duplicate-tracker.cc b/v8/src/inspector/v8-serialization-duplicate-tracker.cc
index 08398216520..43873a62148 100644
--- a/v8/src/inspector/v8-serialization-duplicate-tracker.cc
+++ b/v8/src/inspector/v8-serialization-duplicate-tracker.cc
@@ -47,9 +47,9 @@ V8SerializationDuplicateTracker::LinkExistingOrCreate(
 }
 
 namespace {
-// This tag value has been picked arbitrarily between 0 and
-// V8_EXTERNAL_POINTER_TAG_COUNT.
-constexpr v8::ExternalPointerTypeTag kDictionaryValueTag = 11;
+// See the comment on V8Console::kV8ConsoleTag for why this is allocated from
+// the top of the embedder-reserved range.
+constexpr v8::ExternalPointerTypeTag kDictionaryValueTag = 36;
 }  // namespace
 
 void V8SerializationDuplicateTracker::SetKnownSerializedValue(