diff --git a/chrome/browser/extensions/api/developer_private/developer_private_functions.cc b/chrome/browser/extensions/api/developer_private/developer_private_functions.cc
index 17baf6668e246..dfe589b3a82e8 100644
--- a/chrome/browser/extensions/api/developer_private/developer_private_functions.cc
+++ b/chrome/browser/extensions/api/developer_private/developer_private_functions.cc
@@ -617,7 +617,10 @@ DeveloperPrivateUpdateExtensionConfigurationFunction::Run() {
 
   const developer::ExtensionConfigurationUpdate& update = params->update;
 
-  const Extension* extension = GetExtensionById(update.extension_id);
+  // SetAllowFileAccess() / SetIsIncognitoEnabled() below may synchronously
+  // reload the target extension, dropping the registry's reference to the old
+  // Extension. Hold a scoped_refptr so subsequent uses remain valid.
+  scoped_refptr<const Extension> extension(GetExtensionById(update.extension_id));
   if (!extension) {
     return RespondNow(LogNoSuchExtensionFoundAndReturn());
   }