diff --git a/dom/media/mediasession/MediaSession.cpp b/dom/media/mediasession/MediaSession.cpp
index ae8bce21da6..d54c352493f 100644
--- a/dom/media/mediasession/MediaSession.cpp
+++ b/dom/media/mediasession/MediaSession.cpp
@@ -78,6 +78,13 @@ MediaSession::MediaSession(nsPIDOMWindowInner* aParent)
   }
 }
 
+MediaSession::~MediaSession() { DisconnectRequestAndListener(); }
+
+void MediaSession::DisconnectRequestAndListener() {
+  mLoadingArtworkRequest.DisconnectIfExists();
+  mMetadataChangeListener.DisconnectIfExists();
+}
+
 void MediaSession::Shutdown() {
   if (mDoc) {
     mDoc->UnregisterActivityObserver(this);
@@ -85,8 +92,7 @@ void MediaSession::Shutdown() {
   if (mParent) {
     SetMediaSessionDocStatus(SessionDocStatus::eInactive);
   }
-  mLoadingArtworkRequest.DisconnectIfExists();
-  mMetadataChangeListener.DisconnectIfExists();
+  DisconnectRequestAndListener();
 }
 
 void MediaSession::NotifyOwnerDocumentActivityChanged() {
@@ -119,7 +125,12 @@ MediaMetadata* MediaSession::GetMetadata() const { return mMediaMetadata; }
 void MediaSession::SetMetadata(MediaMetadata* aMetadata) {
   mMetadataChangeListener.DisconnectIfExists();
   mMediaMetadata = aMetadata;
-  if (mMediaMetadata) {
+  // Do not register a raw-pointer listener while inactive. eInactive covers
+  // both bfcache (temporary, session may resume) and Navigator::Invalidate()
+  // (permanent teardown). We still update mMediaMetadata above so that
+  // NotifyMediaSessionAttributes() can resync it when the session becomes
+  // active again after bfcache restore.
+  if (mMediaMetadata && mSessionDocState != SessionDocStatus::eInactive) {
     mMetadataChangeListener = mMediaMetadata->MetadataChangeEvent().Connect(
         AbstractThread::MainThread(), this,
         &MediaSession::NotifyMetadataUpdated);
diff --git a/dom/media/mediasession/MediaSession.h b/dom/media/mediasession/MediaSession.h
index 05d9e9527ec..f1a3a0752a7 100644
--- a/dom/media/mediasession/MediaSession.h
+++ b/dom/media/mediasession/MediaSession.h
@@ -112,7 +112,9 @@ class MediaSession final : public nsIDocumentActivity, public nsWrapperCache {
 
   MediaSessionActionHandler* GetActionHandler(MediaSessionAction aAction) const;
 
-  ~MediaSession() = default;
+  void DisconnectRequestAndListener();
+
+  ~MediaSession();
 
   nsCOMPtr<nsPIDOMWindowInner> mParent;