diff --git a/device/bluetooth/bluetooth_socket_mac.mm b/device/bluetooth/bluetooth_socket_mac.mm
index 315f1ddfe4d20..2256e256036dc 100644
--- a/device/bluetooth/bluetooth_socket_mac.mm
+++ b/device/bluetooth/bluetooth_socket_mac.mm
@@ -1040,8 +1040,17 @@ void BluetoothSocketMac::ReleaseChannel() {
 
   // Closing the channel above prevents the callback delegate from being called
   // so it is now safe to release all callback state.
-  connect_callbacks_.reset();
-  receive_callbacks_.reset();
+  //
+  // Move the callback containers into locals before destroying them. For
+  // incoming connections accepted via AcceptConnectionRequest(), the
+  // success_callback inside |connect_callbacks_| holds the only
+  // scoped_refptr to |this|; resetting it in place would synchronously run
+  // ~BluetoothSocketMac() and the subsequent member accesses below would be a
+  // use-after-free.
+  std::unique_ptr<ConnectCallbacks> connect_callbacks =
+      std::move(connect_callbacks_);
+  std::unique_ptr<ReceiveCallbacks> receive_callbacks =
+      std::move(receive_callbacks_);
   empty_queue(receive_queue_);
   empty_queue(send_queue_);
 }