diff --git a/third_party/blink/renderer/core/inspector/inspector_memory_agent.cc b/third_party/blink/renderer/core/inspector/inspector_memory_agent.cc
index 50c25928577a3..e2860f9bd0dfd 100644
--- a/third_party/blink/renderer/core/inspector/inspector_memory_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_memory_agent.cc
@@ -68,7 +68,11 @@ protocol::Response InspectorMemoryAgent::getDOMCounters(
 }
 
 protocol::Response InspectorMemoryAgent::forciblyPurgeJavaScriptMemory() {
-  for (const auto& page : Page::OrdinaryPages()) {
+  // Snapshot the page set: ForciblyPurgeV8Memory() can re-enter author script
+  // (e.g. via NavigateEvent abort signals) which may window.open() and mutate
+  // OrdinaryPages() during iteration, freeing the live HeapHashSet backing.
+  HeapVector<Member<Page>> pages(Page::OrdinaryPages());
+  for (const auto& page : pages) {
     for (Frame* frame = page->MainFrame(); frame;
          frame = frame->Tree().TraverseNext()) {
       LocalFrame* local_frame = DynamicTo<LocalFrame>(frame);