diff --git a/chrome/browser/plugins/plugin_observer.cc b/chrome/browser/plugins/plugin_observer.cc
--- a/chrome/browser/plugins/plugin_observer.cc
+++ b/chrome/browser/plugins/plugin_observer.cc
@@ -53,6 +53,13 @@ void PluginObserver::OpenPDF(const GURL& url) {
   if (extensions::WebViewGuest::FromRenderFrameHost(render_frame_host))
     return;

+  // Only the primary page's active RenderFrameHost may start downloads or
+  // display tab-anchored UI. A BFCached / pending-deletion RFH must not act
+  // on behalf of the (cross-origin) page now shown in this tab.
+  if (!render_frame_host->IsActive()) {
+    return;
+  }
+
   content::Referrer referrer;
   if (!CanOpenPdfUrl(render_frame_host, url,
                      web_contents()->GetLastCommittedURL(), &referrer)) {
diff --git a/chrome/browser/plugins/plugin_observer_android.cc b/chrome/browser/plugins/plugin_observer_android.cc
--- a/chrome/browser/plugins/plugin_observer_android.cc
+++ b/chrome/browser/plugins/plugin_observer_android.cc
@@ -33,6 +33,13 @@ void PluginObserverAndroid::OpenPDF(const GURL& url) {
   content::RenderFrameHost* render_frame_host =
       plugin_host_receivers_.GetCurrentTargetFrame();

+  // Only the primary page's active RenderFrameHost may navigate the tab or
+  // display UI. A BFCached / pending-deletion RFH must not act on behalf of
+  // the (cross-origin) page now shown in this tab.
+  if (!render_frame_host->IsActive()) {
+    return;
+  }
+
   content::Referrer referrer;
   if (!CanOpenPdfUrl(render_frame_host, url,
                      GetWebContents().GetLastCommittedURL(), &referrer)) {