diff --git a/chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc b/chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc
index 53816cc..81a993c 100644
--- a/chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc
+++ b/chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc
@@ -141,7 +141,11 @@
         browser_widget_->tab_drag_kind() == TabDragKind::kAllTabs;
     bool is_dragging_window = tab_drag_kind == TabDragKind::kAllTabs;
     if (is_dragging_window != was_dragging_window) {
+      auto weak_this = weak_factory_.GetWeakPtr();
       x11_extension->SetOverrideRedirect(is_dragging_window);
+      if (!weak_this) {
+        return;
+      }
     }
   }
 
diff --git a/chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.h b/chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.h
index b4a7275b..97b931d 100644
--- a/chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.h
+++ b/chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.h
@@ -6,6 +6,7 @@
 #define CHROME_BROWSER_UI_VIEWS_FRAME_BROWSER_DESKTOP_WINDOW_TREE_HOST_LINUX_H_
 
 #include "base/memory/raw_ptr.h"
+#include "base/memory/weak_ptr.h"
 #include "build/build_config.h"
 #include "build/config/linux/dbus/buildflags.h"
 #include "chrome/browser/ui/views/frame/browser_desktop_window_tree_host.h"
@@ -109,6 +110,8 @@
 
   base::ScopedObservation<ui::LinuxUi, ui::DeviceScaleFactorObserver>
       scale_observation_{this};
+
+  base::WeakPtrFactory<BrowserDesktopWindowTreeHostLinux> weak_factory_{this};
 };
 
 #endif  // CHROME_BROWSER_UI_VIEWS_FRAME_BROWSER_DESKTOP_WINDOW_TREE_HOST_LINUX_H_
diff --git a/ui/ozone/platform/x11/x11_window.cc b/ui/ozone/platform/x11/x11_window.cc
index 57ffaee..fd71f18 100644
--- a/ui/ozone/platform/x11/x11_window.cc
+++ b/ui/ozone/platform/x11/x11_window.cc
@@ -1333,7 +1333,11 @@
       .override_redirect = x11::Bool32(override_redirect),
   });
   if (remap) {
+    auto weak_this = weak_ptr_factory_.GetWeakPtr();
     Map();
+    if (!weak_this) {
+      return;
+    }
     // We cannot regrab the pointer now since unmapping/mapping
     // happens asynchronously.  We must wait until the window is
     // mapped to issue a grab request.
diff --git a/ui/ozone/platform/x11/x11_window_ozone_unittest.cc b/ui/ozone/platform/x11/x11_window_ozone_unittest.cc
index e56645c..9289d8c 100644
--- a/ui/ozone/platform/x11/x11_window_ozone_unittest.cc
+++ b/ui/ozone/platform/x11/x11_window_ozone_unittest.cc
@@ -486,4 +486,77 @@
   connection->DestroyWindow({new_parent});
 }
 
+// Verifies that X11Window::SetOverrideRedirect() does not cause a
+// use-after-free if the window is synchronously deleted during Map().
+TEST_F(X11WindowOzoneTest, SetOverrideRedirectSelfDeleteUaf) {
+  testing::NiceMock<MockPlatformWindowDelegate> delegate;
+  gfx::AcceleratedWidget widget;
+  constexpr gfx::Rect bounds(30, 80, 800, 600);
+  std::unique_ptr<PlatformWindow> window =
+      CreatePlatformWindow(&delegate, bounds, &widget, nullptr);
+
+  auto* connection = x11::Connection::Get();
+  auto xwindow = static_cast<x11::Window>(widget);
+
+  // Prime the X11Window's `GeometryCache` so the first `Map()` /
+  // `GetBoundsInPixels()` does not itself fire a synchronous
+  // `OnBoundsChanged()`.
+  window->GetBoundsInPixels();
+
+  // Show the window so window_mapped_in_client_ becomes true (allowing remap).
+  window->Show(false);
+
+  // Create a real parent window at a non-zero offset so that after
+  // a synthetic reparent, only the absolute origin of `xwindow` changes.
+  // `override_redirect` avoids any WM interference.
+  x11::Window new_parent = connection->GenerateId<x11::Window>();
+  connection->CreateWindow({
+      .wid = new_parent,
+      .parent = connection->default_root(),
+      .x = 200,
+      .y = 200,
+      .width = 1000,
+      .height = 1000,
+      .c_class = x11::WindowClass::InputOnly,
+      .override_redirect = x11::Bool32(true),
+  });
+
+  // Synthesize a `ReparentNotify` so the leaf `GeometryCache` becomes
+  // un-ready. The next `GetBoundsInPixels()` (inside the `Map()` called
+  // from `SetOverrideRedirect()`) will block on the new parent's geometry,
+  // observe an origin change, and fire `OnBoundsChanged()` synchronously.
+  x11::ReparentNotifyEvent reparent{};
+  reparent.event = xwindow;
+  reparent.window = xwindow;
+  reparent.parent = new_parent;
+  reparent.x = 0;
+  reparent.y = 0;
+  x11::Event reparent_event(/*send_event=*/false, std::move(reparent));
+  connection->DispatchEvent(reparent_event);
+
+  // Arm the delegate so the next synchronous `OnBoundsChanged()` frees
+  // the `X11Window`.
+  bool armed = true;
+  bool freed = false;
+  EXPECT_CALL(delegate, OnBoundsChanged(_))
+      .WillRepeatedly([&](const PlatformWindowDelegate::BoundsChange&) {
+        if (armed) {
+          armed = false;
+          freed = true;
+          window.reset();
+        }
+      });
+
+  // Call `SetOverrideRedirect` via the `X11Extension` interface on X11Window.
+  auto* x11_window_raw = static_cast<X11Window*>(window.get());
+  x11_window_raw->SetOverrideRedirect(true);
+
+  // The synchronous-free path must have been exercised; otherwise the test
+  // didn't reach the vulnerable frame.
+  EXPECT_TRUE(freed) << "delegate->OnBoundsChanged() was not invoked "
+                        "synchronously from SetOverrideRedirect";
+
+  connection->DestroyWindow({new_parent});
+}
+
 }  // namespace ui

diff --git a/ui/ozone/platform/x11/x11_window_ozone_unittest.cc b/ui/ozone/platform/x11/x11_window_ozone_unittest.cc
index e56645c..9289d8c 100644
--- a/ui/ozone/platform/x11/x11_window_ozone_unittest.cc
+++ b/ui/ozone/platform/x11/x11_window_ozone_unittest.cc
@@ -486,4 +486,77 @@
   connection->DestroyWindow({new_parent});
 }
 
+// Verifies that X11Window::SetOverrideRedirect() does not cause a
+// use-after-free if the window is synchronously deleted during Map().
+TEST_F(X11WindowOzoneTest, SetOverrideRedirectSelfDeleteUaf) {
+  testing::NiceMock<MockPlatformWindowDelegate> delegate;
+  gfx::AcceleratedWidget widget;
+  constexpr gfx::Rect bounds(30, 80, 800, 600);
+  std::unique_ptr<PlatformWindow> window =
+      CreatePlatformWindow(&delegate, bounds, &widget, nullptr);
+
+  auto* connection = x11::Connection::Get();
+  auto xwindow = static_cast<x11::Window>(widget);
+
+  // Prime the X11Window's `GeometryCache` so the first `Map()` /
+  // `GetBoundsInPixels()` does not itself fire a synchronous
+  // `OnBoundsChanged()`.
+  window->GetBoundsInPixels();
+
+  // Show the window so window_mapped_in_client_ becomes true (allowing remap).
+  window->Show(false);
+
+  // Create a real parent window at a non-zero offset so that after
+  // a synthetic reparent, only the absolute origin of `xwindow` changes.
+  // `override_redirect` avoids any WM interference.
+  x11::Window new_parent = connection->GenerateId<x11::Window>();
+  connection->CreateWindow({
+      .wid = new_parent,
+      .parent = connection->default_root(),
+      .x = 200,
+      .y = 200,
+      .width = 1000,
+      .height = 1000,
+      .c_class = x11::WindowClass::InputOnly,
+      .override_redirect = x11::Bool32(true),
+  });
+
+  // Synthesize a `ReparentNotify` so the leaf `GeometryCache` becomes
+  // un-ready. The next `GetBoundsInPixels()` (inside the `Map()` called
+  // from `SetOverrideRedirect()`) will block on the new parent's geometry,
+  // observe an origin change, and fire `OnBoundsChanged()` synchronously.
+  x11::ReparentNotifyEvent reparent{};
+  reparent.event = xwindow;
+  reparent.window = xwindow;
+  reparent.parent = new_parent;
+  reparent.x = 0;
+  reparent.y = 0;
+  x11::Event reparent_event(/*send_event=*/false, std::move(reparent));
+  connection->DispatchEvent(reparent_event);
+
+  // Arm the delegate so the next synchronous `OnBoundsChanged()` frees
+  // the `X11Window`.
+  bool armed = true;
+  bool freed = false;
+  EXPECT_CALL(delegate, OnBoundsChanged(_))
+      .WillRepeatedly([&](const PlatformWindowDelegate::BoundsChange&) {
+        if (armed) {
+          armed = false;
+          freed = true;
+          window.reset();
+        }
+      });
+
+  // Call `SetOverrideRedirect` via the `X11Extension` interface on X11Window.
+  auto* x11_window_raw = static_cast<X11Window*>(window.get());
+  x11_window_raw->SetOverrideRedirect(true);
+
+  // The synchronous-free path must have been exercised; otherwise the test
+  // didn't reach the vulnerable frame.
+  EXPECT_TRUE(freed) << "delegate->OnBoundsChanged() was not invoked "
+                        "synchronously from SetOverrideRedirect";
+
+  connection->DestroyWindow({new_parent});
+}
+
 }  // namespace ui