diff --git a/content/browser/screen_orientation/screen_orientation_browsertest.cc b/content/browser/screen_orientation/screen_orientation_browsertest.cc
index 2d14955607369..c48475563d761 100644
--- a/content/browser/screen_orientation/screen_orientation_browsertest.cc
+++ b/content/browser/screen_orientation/screen_orientation_browsertest.cc
@@ -535,4 +535,102 @@ IN_PROC_BROWSER_TEST_F(ScreenOrientationLockForPrerenderBrowserTest,
   EXPECT_EQ(0, delegate.unlock_count());
 }
 
+// Regression test for a use-after-free in WidgetBase::UpdateSurfaceAndScreenInfo
+// when a synchronous `orientationchange` event handler detaches the local-root
+// frame whose WidgetBase is currently processing the visual property update.
+//
+// The legacy `orientationchange` event (RuntimeEnabledFeatures::OrientationEvent)
+// is dispatched synchronously from WidgetBase::UpdateSurfaceAndScreenInfo via
+// client_->OrientationChanged(). It is enabled by default on Android. This test
+// enables it explicitly so the synchronous dispatch path is exercised on all
+// platforms.
+//
+// Frame topology (with site isolation):
+//   a.com (outer, local root W1 in process P_A)
+//     +-- b.com (remote in P_A, local root in P_B)
+//           +-- a.com (inner, local root W2 in process P_A)
+//
+// When W2 receives an orientation change, it synchronously dispatches the
+// `orientationchange` event on the inner a.com window. The handler reaches into
+// outer a.com via window.top (same-origin) and removes the b.com <iframe>.
+// Detaching the b.com RemoteFrame in P_A cascades to detaching its child, the
+// inner a.com LocalFrame, which is a local root: WebFrameWidgetImpl::Close()
+// runs and resets widget_base_, freeing W2. Execution then returns to
+// W2::UpdateSurfaceAndScreenInfo, where `this` is now dangling and the
+// subsequent client_->DidUpdateSurfaceAndScreen() is a use-after-free.
+class ScreenOrientationWidgetUAFBrowserTest
+    : public ScreenOrientationOOPIFBrowserTest {
+ public:
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    ScreenOrientationOOPIFBrowserTest::SetUpCommandLine(command_line);
+    // Enable the legacy synchronous window.onorientationchange event, which is
+    // shipped by default on Android.
+    command_line->AppendSwitchASCII(switches::kEnableBlinkFeatures,
+                                    "OrientationEvent");
+  }
+};
+
+IN_PROC_BROWSER_TEST_F(ScreenOrientationWidgetUAFBrowserTest,
+                       DetachLocalRootDuringOrientationChange) {
+  // a(b(a)): outer a.com -> b.com -> inner a.com.
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b(a))"));
+  ASSERT_TRUE(NavigateToURL(shell(), main_url));
+  WaitForResizeComplete(shell()->web_contents());
+
+  FrameTreeNode* root = web_contents()->GetPrimaryFrameTree().root();
+  ASSERT_EQ(1u, root->child_count());
+  FrameTreeNode* b_node = root->child_at(0);
+  ASSERT_EQ(1u, b_node->child_count());
+  FrameTreeNode* inner_a_node = b_node->child_at(0);
+
+  RenderFrameHostImpl* outer_a = root->current_frame_host();
+  RenderFrameHostImpl* inner_a = inner_a_node->current_frame_host();
+
+  // Inner a.com must be in the same renderer process as outer a.com (so it can
+  // synchronously script window.top), and must be a local root with its own
+  // RenderWidgetHost (so detaching it destroys a WidgetBase).
+  ASSERT_EQ(outer_a->GetProcess(), inner_a->GetProcess());
+  ASSERT_NE(outer_a->GetRenderWidgetHost(), inner_a->GetRenderWidgetHost());
+  ASSERT_TRUE(inner_a->is_local_root());
+
+  // Give the b.com iframe element in outer a.com a stable id.
+  ASSERT_TRUE(
+      ExecJs(outer_a, "document.querySelector('iframe').id = 'victim';"));
+
+  // In the inner a.com frame, register a synchronous orientationchange handler
+  // that detaches the b.com iframe via window.top. This will synchronously
+  // detach the inner a.com local root (and free its WidgetBase) while
+  // WidgetBase::UpdateSurfaceAndScreenInfo is still on the stack.
+  ASSERT_TRUE(ExecJs(inner_a, R"(
+      window.addEventListener('orientationchange', () => {
+        window.top.document.getElementById('victim').remove();
+      });
+  )"));
+
+  // Send an orientation change directly to the inner a.com widget. This
+  // simulates the browser-side half of a device rotation as it applies to a
+  // child local root. SynchronizeVisualProperties() may be throttled by a
+  // pending ack, so clear that first.
+  RenderWidgetHostImpl* inner_widget =
+      static_cast<RenderWidgetHostImpl*>(inner_a->GetRenderWidgetHost());
+  inner_widget->ClearVisualProperties();
+  inner_widget->SetScreenOrientationForTesting(
+      90, display::mojom::ScreenOrientation::kPortraitPrimary);
+
+  // Wait for the renderer to process the visual property update. On a
+  // vulnerable build, ASAN reports heap-use-after-free in
+  // blink::WidgetBase::UpdateSurfaceAndScreenInfo before this returns.
+  {
+    MainThreadFrameObserver observer(outer_a->GetRenderWidgetHost());
+    observer.Wait();
+  }
+
+  // If we get here without an ASAN report, either the bug is fixed or the
+  // freed memory was not poisoned in time. Sanity-check that the handler ran.
+  EXPECT_EQ(true,
+            EvalJs(outer_a,
+                   "document.getElementById('victim') === null"));
+}
+
 } // namespace content