diff --git a/content/browser/renderer_host/navigator.cc b/content/browser/renderer_host/navigator.cc
index 9b7639d45505f..4c5bbee5c5298 100644
--- a/content/browser/renderer_host/navigator.cc
+++ b/content/browser/renderer_host/navigator.cc
@@ -533,6 +533,17 @@ void Navigator::DidNavigate(
   // NOTE: the pre commit tasks may result in the destruction of the render
   // frame host, in which case we should exit this method early.
   if (!weak_rfh) {
+    // The WebContents (and the FrameTreeNode/Navigator embedded within it)
+    // was destroyed while DidNavigateAnyFramePreCommit() ran the macOS
+    // ExitFullscreenModeForTab nested run loop. Running ~NavigationRequest
+    // here would dereference its RAW_PTR_EXCLUSION `frame_tree_node_` member
+    // (and chain through Navigator/NavigatorDelegate) into the freed
+    // WebContentsImpl allocation. Intentionally leak the request instead of
+    // letting the unique_ptr destroy it; trading a bounded one-shot leak in
+    // an already-exceptional shutdown path for memory safety.
+    // TODO(crbug.com/1506535): Teach ~NavigationRequest to tolerate a dead
+    // FrameTreeNode and remove this leak.
+    navigation_request.release();
     return;
   }