diff --git a/net/cert/internal/trust_store_nss.cc b/net/cert/internal/trust_store_nss.cc
index 08f16e058fd1b..73120631c0637 100644
--- a/net/cert/internal/trust_store_nss.cc
+++ b/net/cert/internal/trust_store_nss.cc
@@ -304,6 +304,19 @@ bssl::CertificateTrust TrustStoreNSS::GetTrust(
     return bssl::CertificateTrust::ForUnspecified();
   }
 
+  // CERT_FindCertByDERCert resolves the input DER to (issuer, serialNumber)
+  // and returns any certificate NSS has cached/stored under that key -- it
+  // does not check that the returned certificate's DER actually equals the
+  // input. If they differ, the trust record we would read below belongs to a
+  // different certificate than `cert`, so treat `cert` as unknown rather than
+  // aliasing another certificate's trust onto it.
+  if (!std::ranges::equal(x509_util::CERTCertificateAsSpan(nss_cert.get()),
+                          cert->der_cert())) {
+    DVLOG(1) << "skipped cert whose DER does not match the (issuer,serial) "
+                "aliased NSS certificate";
+    return bssl::CertificateTrust::ForUnspecified();
+  }
+
   return GetTrustIgnoringSystemTrust(nss_cert.get());
 }