diff --git a/patch/patch.cfg b/patch/patch.cfg
index b05af94c3..d80af1b66 100644
--- a/patch/patch.cfg
+++ b/patch/patch.cfg
@@ -525,5 +525,10 @@ patches = [
     # Linux: Fix ATK assertion error when generating ARM build config.
     # https://bugs.chromium.org/p/chromium/issues/detail?id=1123214
     'name': 'linux_atk_1123214',
+  },
+  {
+    # Fix underflow in EventRouterForwarder::HandleEvent.
+    # https://bugs.chromium.org/p/chromium/issues/detail?id=1167149#c7
+    'name': 'chrome_extensions_event_router_3066',
   }
 ]
diff --git a/patch/patches/chrome_extensions_event_router_3066.patch b/patch/patches/chrome_extensions_event_router_3066.patch
new file mode 100644
index 000000000..8927d55eb
--- /dev/null
+++ b/patch/patches/chrome_extensions_event_router_3066.patch
@@ -0,0 +1,27 @@
+diff --git chrome/browser/extensions/event_router_forwarder.cc chrome/browser/extensions/event_router_forwarder.cc
+index ba788f3a937f..627ea39e4648 100644
+--- chrome/browser/extensions/event_router_forwarder.cc
++++ chrome/browser/extensions/event_router_forwarder.cc
+@@ -100,14 +100,18 @@ void EventRouterForwarder::HandleEvent(
+     }
+   }
+ 
+-  DCHECK_GT(profiles_to_dispatch_to.size(), 0u)
+-      << "There should always be at least one profile!";
++  // There should always be at least one profile when running as Chromium.
++  // However, some Chromium embedders are known to run without profiles, in
++  // which case there's nothing to dispatch to.
++  if (profiles_to_dispatch_to.size() == 0u)
++    return;
+ 
++  // Use the same event_args for each profile (making copies as needed).
+   std::vector<std::unique_ptr<base::ListValue>> per_profile_args;
+   per_profile_args.reserve(profiles_to_dispatch_to.size());
+-  for (size_t i = 0; i < profiles_to_dispatch_to.size() - 1; ++i)
+-    per_profile_args.emplace_back(event_args->DeepCopy());
+   per_profile_args.emplace_back(std::move(event_args));
++  for (size_t i = 1; i < profiles_to_dispatch_to.size(); ++i)
++    per_profile_args.emplace_back(per_profile_args.front()->DeepCopy());
+   DCHECK_EQ(per_profile_args.size(), profiles_to_dispatch_to.size());
+ 
+   size_t profile_args_index = 0;