diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
index bb1cbe715ec41..1a4c0c00d55e3 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
@@ -3427,9 +3427,18 @@ void RenderWidgetHostViewAura::OnUpdateTextInputStateCalled(
   if (!GetInputMethod())
     return;
 
+  // OnTextInputTypeChanged() reaches platform IME backends (e.g. Windows TSF
+  // COM) which may pump the UI message loop and synchronously destroy `this`.
+  base::WeakPtr<RenderWidgetHostViewAura> weak_this =
+      weak_ptr_factory_.GetWeakPtr();
+
   if (did_update_state)
     GetInputMethod()->OnTextInputTypeChanged(this);
 
+  if (!weak_this) {
+    return;
+  }
+
   const ui::mojom::TextInputState* state =
       text_input_manager_->GetTextInputState();