diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
index 8949727d76136..96e7a8549c842 100644
--- a/content/browser/renderer_host/render_frame_host_impl.cc
+++ b/content/browser/renderer_host/render_frame_host_impl.cc
@@ -7153,6 +7153,12 @@ void RenderFrameHostImpl::OnUnloadACK() {
       owner->GetRenderFrameHostManager().is_inner_delegate_attached()) {
     // This RFH was unloaded while attaching an inner delegate. The RFH
     // will stay around but it will no longer be associated with a RenderFrame.
+    // A compromised renderer may have added children to the placeholder via
+    // FrameHost::CreateChildFrame before this ACK; tear them down so the
+    // placeholder does not simultaneously host an inner WebContents and own
+    // ordinary child FrameTreeNodes (see also the process-death path which
+    // pairs ResetChildren() with RenderFrameDeleted()).
+    ResetChildren();
     RenderFrameDeleted();
     return;
   }