diff --git a/extensions/renderer/guest_view/mime_handler_view/post_message_support.cc b/extensions/renderer/guest_view/mime_handler_view/post_message_support.cc
index 869bfb9066aea..54fad82f2c203 100644
--- a/extensions/renderer/guest_view/mime_handler_view/post_message_support.cc
+++ b/extensions/renderer/guest_view/mime_handler_view/post_message_support.cc
@@ -148,9 +148,17 @@ void PostMessageSupport::PostJavaScriptMessage(v8::Isolate* isolate,
       target_frame->GlobalProxy(isolate);
   gin::Dictionary window_object(isolate, target_window_proxy);
   v8::Local<v8::Function> post_message;
+  // gin::Dictionary::Get() wraps v8::Object::Get() which can synchronously run
+  // attacker-installed accessor getters; those can detach the embedder frame
+  // and free |this|. Hold a WeakPtr across the call.
+  auto weak_this = weak_factory_.GetWeakPtr();
   if (!window_object.Get(std::string(kPostMessageName), &post_message)) {
     return;
   }
+  if (!weak_this) {
+    // |this| was freed under the getter.
+    return;
+  }
 
   v8::Local<v8::Value> args[] = {
       message,