diff --git a/third_party/blink/renderer/core/html/html_stream.cc b/third_party/blink/renderer/core/html/html_stream.cc
index 0296bfec0c850..ec516744afb8c 100644
--- a/third_party/blink/renderer/core/html/html_stream.cc
+++ b/third_party/blink/renderer/core/html/html_stream.cc
@@ -157,6 +157,16 @@ WritableStream* HTMLStream::Create(ScriptState* script_state,
     return nullptr;
   }

+  // Safe-mode setters must not insert text into <script>/<svg:script>, since
+  // any inserted text becomes executable script source. Mirror the guard in
+  // ParseHTMLFragment (fragment_parser.cc) that the non-stream setters use.
+  if (!SanitizerAPI::AllowMutatingRootElement(sanitizer_mode, target)) {
+    exception_state.ThrowDOMException(
+        DOMExceptionCode::kHierarchyRequestError,
+        "Cannot stream into a script element in safe mode");
+    return nullptr;
+  }
+
   std::optional<FragmentParserOptions> trusted_options =
       sanitizer_mode == Sanitizer::Mode::kSafe
           ? std::make_optional(options)