diff --git a/chrome/browser/extensions/api/management/chrome_management_api_delegate_non_android.cc b/chrome/browser/extensions/api/management/chrome_management_api_delegate_non_android.cc index 879b267e5318f..74376e4c1ba65 100644 --- a/chrome/browser/extensions/api/management/chrome_management_api_delegate_non_android.cc +++ b/chrome/browser/extensions/api/management/chrome_management_api_delegate_non_android.cc @@ -246,15 +246,25 @@ void OnWebAppInstallabilityChecked( std::move(callback).Run(InstallOrLaunchWebAppResult::kInvalidWebApp); return; case InstallableCheckResult::kInstallable: - content::WebContents* containing_contents = web_contents.get(); + base::WeakPtr containing_contents = + web_contents->GetWeakPtr(); chrome::ScopedTabbedBrowserDisplayer displayer(profile.get()); const GURL& url = web_contents->GetLastCommittedURL(); chrome::AddWebContents(displayer.browser(), nullptr, std::move(web_contents), url, WindowOpenDisposition::NEW_FOREGROUND_TAB, blink::mojom::WindowFeatures()); + // chrome::AddWebContents() may drop the moved-in WebContents instead of + // inserting it into a tab strip (e.g. when PWA Navigation Capturing + // returns a focus-existing override with browser=nullptr). Guard against + // dereferencing the freed pointer. + if (!containing_contents) { + std::move(callback).Run(InstallOrLaunchWebAppResult::kUnknownError); + return; + } web_app::CreateWebAppFromManifest( - containing_contents, webapps::WebappInstallSource::MANAGEMENT_API, + containing_contents.get(), + webapps::WebappInstallSource::MANAGEMENT_API, base::BindOnce(&OnWebAppInstallCompleted, std::move(callback))); return; }