diff --git a/services/network/restricted_cookie_manager.cc b/services/network/restricted_cookie_manager.cc
index 1c9e46f741501..8e6335cb4a424 100644
--- a/services/network/restricted_cookie_manager.cc
+++ b/services/network/restricted_cookie_manager.cc
@@ -1032,6 +1032,18 @@ void RestrictedCookieManager::GetCookiesString(
     metrics_updater_->OnGetCookiesString();
   }
 
+  // Validate `url` against the bound origin before any observable side effects.
+  // GetAndPrepareSharedMemoryRegion() unconditionally retargets this RCM's
+  // cookie-change subscription to `url`; without this early check a renderer
+  // could supply a cross-origin URL, fail validation, and still leave the
+  // (now-leaked) RCM subscribed to a foreign origin's cookie changes.
+  if (!ValidateAccessToCookiesAt(url, site_for_cookies, top_frame_origin,
+                                 /*record_metrics=*/false)) {
+    std::move(callback).Run(mojom::kInvalidCookieVersion,
+                            base::ReadOnlySharedMemoryRegion(), "");
+    return;
+  }
+
   base::ReadOnlySharedMemoryRegion shared_memory_region;
   if (get_version_shared_memory) {
     shared_memory_region = GetAndPrepareSharedMemoryRegion(url);