Each file type has 'magic bytes' — a specific sequence of bytes at the beginning of the file that uniquely identifies its type. Validating MIME type from file content using magic bytes is necessary because the browser-supplied Content-Type header is based solely on the file extension and can be spoofed by an attacker.