diff --git a/content/browser/file_system_access/file_system_access_manager_impl.cc b/content/browser/file_system_access/file_system_access_manager_impl.cc
index bf53abc2c8ab1..471e399382018 100644
--- a/content/browser/file_system_access/file_system_access_manager_impl.cc
+++ b/content/browser/file_system_access/file_system_access_manager_impl.cc
@@ -254,6 +254,18 @@ void ShowFilePickerOnUIThread(
     return;
   }
 
+  // ForSecurityDropFullscreen() may spin a nested message loop while exiting
+  // fullscreen (see WebContentsImpl::ExitFullscreenMode and crbug.com/1506535).
+  // The `nullopt` contract above only guarantees that `web_contents` survived;
+  // a subframe `rfh` may have been detached and freed. Re-resolve it.
+  rfh = RenderFrameHost::FromID(frame_id);
+  if (!rfh) {
+    std::move(callback).Run(file_system_access_error::FromStatus(
+                                FileSystemAccessStatus::kOperationAborted),
+                            {});
+    return;
+  }
+
   FileSystemChooser::ScopedObjects scoped_objects(
       /*fullscreen_block=*/std::move(*blocker),
       // Maybe tuck the pip window so that it would not block the file picker