diff --git a/components/cast_streaming/renderer/BUILD.gn b/components/cast_streaming/renderer/BUILD.gn
index 7d470bed1ebc12..f81927c2cc5ddc 100644
--- a/components/cast_streaming/renderer/BUILD.gn
+++ b/components/cast_streaming/renderer/BUILD.gn
@@ -72,6 +72,7 @@ source_set("unit_tests") {
   deps = [
     "//components/cast_streaming/renderer/common:unit_tests",
     "//components/cast_streaming/renderer/control:unit_tests",
+    "//components/cast_streaming/renderer/frame:unit_tests",
     "//components/cast_streaming/renderer/web_codecs:unit_tests",
   ]
 
diff --git a/components/cast_streaming/renderer/frame/BUILD.gn b/components/cast_streaming/renderer/frame/BUILD.gn
index 119efe0da1c498..b3660096e5e59c 100644
--- a/components/cast_streaming/renderer/frame/BUILD.gn
+++ b/components/cast_streaming/renderer/frame/BUILD.gn
@@ -25,3 +25,19 @@ source_set("frame") {
     "//mojo/public/cpp/bindings",
   ]
 }
+
+source_set("unit_tests") {
+  testonly = true
+  public = []
+  sources = [ "demuxer_connector_unittest.cc" ]
+  deps = [
+    ":frame",
+    "//base",
+    "//base/test:test_support",
+    "//components/cast_streaming/common:mojom",
+    "//media:test_support",
+    "//mojo/public/cpp/bindings",
+    "//testing/gmock",
+    "//testing/gtest",
+  ]
+}
diff --git a/components/cast_streaming/renderer/frame/demuxer_connector_unittest.cc b/components/cast_streaming/renderer/frame/demuxer_connector_unittest.cc
new file mode 100644
index 00000000000000..31f614395ccc85
--- /dev/null
+++ b/components/cast_streaming/renderer/frame/demuxer_connector_unittest.cc
@@ -0,0 +1,78 @@
+// Copyright 2024 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/cast_streaming/renderer/frame/demuxer_connector.h"
+
+#include <memory>
+
+#include "base/functional/callback_helpers.h"
+#include "base/test/task_environment.h"
+#include "base/test/test_simple_task_runner.h"
+#include "components/cast_streaming/renderer/frame/frame_injecting_demuxer.h"
+#include "media/base/mock_demuxer_host.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace cast_streaming {
+
+// Regression / proof-of-concept test demonstrating a use-after-free in
+// DemuxerConnector::OnReceiverDisconnected().
+//
+// Scenario (matches what a Cast Receiver page can trigger):
+//   1. Browser binds the renderer-side mojom::DemuxerConnector receiver.
+//   2. Page creates <video src="data:cast_streaming_receiver">; the media
+//      pipeline creates a FrameInjectingDemuxer and calls Initialize() on the
+//      media thread, which posts SetDemuxer(this) back to the main thread.
+//   3. SetDemuxer() stores a raw pointer to the demuxer in |demuxer_|.
+//   4. Page tears down the <video> element before stream initialization
+//      finishes. ~FrameInjectingDemuxer() runs with
+//      |was_initialization_successful_| == false, so it skips the
+//      OnDemuxerDestroyed() notification, leaving |demuxer_| dangling.
+//   5. The Cast session's mojo pipe disconnects. OnReceiverDisconnected()
+//      sees a non-null |demuxer_| with |is_demuxer_initialized_| == false and
+//      invokes demuxer_->OnStreamsInitialized() on freed memory.
+//
+// Under ASAN this test produces a heap-use-after-free report inside
+// FrameInjectingDemuxer::OnStreamsInitialized().
+TEST(DemuxerConnectorUafTest, DanglingDemuxerOnDisconnect) {
+  base::test::TaskEnvironment task_environment;
+
+  // Separate sequence for the media thread, as in production.
+  auto media_task_runner = base::MakeRefCounted<base::TestSimpleTaskRunner>();
+
+  DemuxerConnector connector;
+
+  // Step 1: bind the receiver (simulates the browser-process AssociatedRemote
+  // created by ReceiverSessionImpl/streaming controller).
+  mojo::AssociatedRemote<mojom::DemuxerConnector> remote;
+  connector.BindReceiver(remote.BindNewEndpointAndPassDedicatedReceiver());
+  ASSERT_TRUE(connector.IsBound());
+
+  // Step 2: create the demuxer on the "main" thread and run Initialize() as
+  // the media pipeline does. Initialize() posts SetDemuxer(this) back to the
+  // main thread via |original_task_runner_|.
+  auto demuxer = std::make_unique<FrameInjectingDemuxer>(&connector,
+                                                         media_task_runner);
+  testing::NiceMock<media::MockDemuxerHost> host;
+  static_cast<media::Demuxer*>(demuxer.get())
+      ->Initialize(&host, base::DoNothing());
+
+  // Step 3: drain the main thread so DemuxerConnector::SetDemuxer() runs and
+  // stores the raw |demuxer_| pointer.
+  task_environment.RunUntilIdle();
+
+  // Step 4: destroy the demuxer before initialization completes. The dtor's
+  // |was_initialization_successful_| guard skips OnDemuxerDestroyed(), so
+  // |connector.demuxer_| now dangles.
+  demuxer.reset();
+  task_environment.RunUntilIdle();
+
+  // Step 5: simulate Cast session teardown by closing the remote. The receiver
+  // disconnect handler runs OnReceiverDisconnected(), which dereferences the
+  // dangling |demuxer_| via OnStreamsInitialized().
+  remote.reset();
+  task_environment.RunUntilIdle();  // ASAN: heap-use-after-free here.
+}
+
+}  // namespace cast_streaming