diff --git a/chrome/browser/webauthn/authenticator_request_dialog_controller.cc b/chrome/browser/webauthn/authenticator_request_dialog_controller.cc
index 7ee13e133e9f8..26bb27e5d667f 100644
--- a/chrome/browser/webauthn/authenticator_request_dialog_controller.cc
+++ b/chrome/browser/webauthn/authenticator_request_dialog_controller.cc
@@ -625,7 +625,15 @@ void AuthenticatorRequestDialogController::CancelAuthenticatorRequest() {
   }
 
   if (is_request_complete()) {
+    // SetCurrentStep(kClosed) synchronously destroys the constrained dialog
+    // Widget which (via activation observers) may destroy the hosting
+    // WebContents and therefore `this`. See https://crbug.com/521495992.
+    base::WeakPtr<AuthenticatorRequestDialogController> weak_this =
+        weak_factory_.GetWeakPtr();
     SetCurrentStep(Step::kClosed);
+    if (!weak_this) {
+      return;
+    }
   }
 
   for (auto& observer : model_->observers) {