diff --git a/packages/react-native/ReactCommon/jsinspector-modern/NetworkIOAgent.cpp b/packages/react-native/ReactCommon/jsinspector-modern/NetworkIOAgent.cpp
index 1449de08d07..722578f5514 100644
--- a/packages/react-native/ReactCommon/jsinspector-modern/NetworkIOAgent.cpp
+++ b/packages/react-native/ReactCommon/jsinspector-modern/NetworkIOAgent.cpp
@@ -22,6 +22,7 @@ namespace facebook::react::jsinspector_modern {
 
 static constexpr long DEFAULT_BYTES_PER_READ =
     1048576; // 1MB (Chrome v112 default)
+static constexpr unsigned long MAX_BYTES_PER_READ = 10485760; // 10MB
 
 // https://github.com/chromium/chromium/blob/128.0.6593.1/content/browser/devtools/devtools_io_context.cc#L71-L73
 static constexpr std::array kTextMIMETypePrefixes{
@@ -403,9 +404,17 @@ void NetworkIOAgent::handleIoRead(const cdp::PreparsedRequest& req) {
         "Invalid params: handle is missing or not a string."));
     return;
   }
-  std::optional<unsigned long> size = std::nullopt;
+  std::optional<int64_t> size = std::nullopt;
   if ((req.params.count("size") != 0u) && req.params.at("size").isInt()) {
     size = req.params.at("size").asInt();
+
+    if (size > MAX_BYTES_PER_READ) {
+      frontendChannel_(cdp::jsonError(
+          requestId,
+          cdp::ErrorCode::InvalidParams,
+          "Invalid params: size cannot be greater than 10MB."));
+      return;
+    }
   }
 
   auto streamId = req.params.at("handle").asString();
diff --git a/packages/react-native/ReactCommon/jsinspector-modern/tests/HostTargetTest.cpp b/packages/react-native/ReactCommon/jsinspector-modern/tests/HostTargetTest.cpp
index b9956dc04ca..82bc955762f 100644
--- a/packages/react-native/ReactCommon/jsinspector-modern/tests/HostTargetTest.cpp
+++ b/packages/react-native/ReactCommon/jsinspector-modern/tests/HostTargetTest.cpp
@@ -1501,4 +1501,26 @@ TEST_F(HostTargetTest, NetworkLoadNetworkResource3xx) {
   });
 }
 
+TEST_F(HostTargetTest, IOReadSizeValidation) {
+  connect();
+
+  InSequence s;
+
+  EXPECT_CALL(fromPage(), onMessage(JsonEq(R"({
+                                            "id": 1,
+                                            "error": {
+                                              "message": "Invalid params: size cannot be greater than 10MB.",
+                                              "code": -32602
+                                            }
+                                          })")));
+  toPage_->sendMessage(R"({
+        "id": 1,
+        "method": "IO.read",
+        "params": {
+          "handle": "0",
+          "size": 134217728
+        }
+      })");
+}
+
 } // namespace facebook::react::jsinspector_modern