diff --git a/CHROMIUM_BUILD_COMPATIBILITY.txt b/CHROMIUM_BUILD_COMPATIBILITY.txt
index 4bf1ae1e7..0abb126d1 100644
--- a/CHROMIUM_BUILD_COMPATIBILITY.txt
+++ b/CHROMIUM_BUILD_COMPATIBILITY.txt
@@ -17,5 +17,5 @@
 
 {
   'chromium_url': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_revision': '184577',
+  'chromium_revision': '187216',
 }
diff --git a/cef.gyp b/cef.gyp
index 9a4a21a86..dfc626e40 100644
--- a/cef.gyp
+++ b/cef.gyp
@@ -892,6 +892,7 @@
         'libcef/browser/resource_request_job.cc',
         'libcef/browser/resource_request_job.h',
         'libcef/browser/scheme_impl.cc',
+        'libcef/browser/scheme_impl.h',
         'libcef/browser/scheme_registration.cc',
         'libcef/browser/scheme_registration.h',
         'libcef/browser/speech_recognition_manager_delegate.cc',
diff --git a/libcef/browser/browser_context.cc b/libcef/browser/browser_context.cc
index 76dd71534..911f3185d 100644
--- a/libcef/browser/browser_context.cc
+++ b/libcef/browser/browser_context.cc
@@ -297,26 +297,12 @@ quota::SpecialStoragePolicy* CefBrowserContext::GetSpecialStoragePolicy() {
 }
 
 net::URLRequestContextGetter* CefBrowserContext::CreateRequestContext(
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        blob_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        file_system_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        developer_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        chrome_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        chrome_devtools_protocol_handler) {
+    content::ProtocolHandlerMap* protocol_handlers) {
   DCHECK(!url_request_getter_);
-  // CEF doesn't use URLDataManager for serving chrome internal protocols.
-  // |chrome_protocol_handler| and |chrome_devtools_protocol_handler| are
-  // ignored so as not to conflict with CEF's protocol implementation.
   url_request_getter_ = new CefURLRequestContextGetter(
       BrowserThread::UnsafeGetMessageLoopForThread(BrowserThread::IO),
       BrowserThread::UnsafeGetMessageLoopForThread(BrowserThread::FILE),
-      blob_protocol_handler.Pass(),
-      file_system_protocol_handler.Pass(),
-      developer_protocol_handler.Pass());
+      protocol_handlers);
   resource_context_->set_url_request_context_getter(url_request_getter_.get());
   return url_request_getter_.get();
 }
@@ -325,16 +311,7 @@ net::URLRequestContextGetter*
     CefBrowserContext::CreateRequestContextForStoragePartition(
         const base::FilePath& partition_path,
         bool in_memory,
-        scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-            blob_protocol_handler,
-        scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-            file_system_protocol_handler,
-        scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-            developer_protocol_handler,
-        scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-            chrome_protocol_handler,
-        scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-            chrome_devtools_protocol_handler) {
+        content::ProtocolHandlerMap* protocol_handlers) {
   return NULL;
 }
 
diff --git a/libcef/browser/browser_context.h b/libcef/browser/browser_context.h
index d7728aed9..e9799922f 100644
--- a/libcef/browser/browser_context.h
+++ b/libcef/browser/browser_context.h
@@ -11,6 +11,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
 #include "content/public/browser/browser_context.h"
+#include "content/public/browser/content_browser_client.h"
 #include "net/url_request/url_request_job_factory.h"
 
 namespace content {
@@ -48,29 +49,11 @@ class CefBrowserContext : public content::BrowserContext {
   virtual quota::SpecialStoragePolicy* GetSpecialStoragePolicy() OVERRIDE;
 
   net::URLRequestContextGetter* CreateRequestContext(
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          blob_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          file_system_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          developer_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          chrome_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          chrome_devtools_protocol_handler);
+      content::ProtocolHandlerMap* protocol_handlers);
   net::URLRequestContextGetter* CreateRequestContextForStoragePartition(
       const base::FilePath& partition_path,
       bool in_memory,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          blob_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          file_system_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          developer_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          chrome_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          chrome_devtools_protocol_handler);
+      content::ProtocolHandlerMap* protocol_handlers);
 
   // To disable window rendering call this function with |override|=true
   // just before calling WebContents::Create. This will cause
diff --git a/libcef/browser/browser_host_impl.cc b/libcef/browser/browser_host_impl.cc
index 46c487860..24ac2480c 100644
--- a/libcef/browser/browser_host_impl.cc
+++ b/libcef/browser/browser_host_impl.cc
@@ -1069,7 +1069,7 @@ gfx::NativeView CefBrowserHostImpl::GetContentView() const {
   CEF_REQUIRE_UIT();
   if (!web_contents_.get())
     return NULL;
-  return web_contents_->GetNativeView();
+  return web_contents_->GetView()->GetNativeView();
 }
 
 content::WebContents* CefBrowserHostImpl::GetWebContents() const {
@@ -1351,7 +1351,7 @@ void CefBrowserHostImpl::OnSetFocus(cef_focus_source_t source) {
     }
 
     if (web_contents_.get())
-      web_contents_->Focus();
+      web_contents_->GetView()->Focus();
   } else {
     CEF_POST_TASK(CEF_UIT,
         base::Bind(&CefBrowserHostImpl::OnSetFocus, this, source));
diff --git a/libcef/browser/browser_main.cc b/libcef/browser/browser_main.cc
index 4837b9e0f..78202c1b6 100644
--- a/libcef/browser/browser_main.cc
+++ b/libcef/browser/browser_main.cc
@@ -16,7 +16,9 @@
 #include "base/message_loop.h"
 #include "base/string_number_conversions.h"
 #include "chrome/browser/net/proxy_service_factory.h"
+#include "content/browser/webui/content_web_ui_controller_factory.h"
 #include "content/public/browser/gpu_data_manager.h"
+#include "content/public/browser/web_ui_controller_factory.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "net/base/net_module.h"
@@ -51,6 +53,13 @@ void CefBrowserMainParts::PreMainMessageLoopStart() {
   }
 }
 
+void CefBrowserMainParts::PostMainMessageLoopStart() {
+  // Don't use the default WebUI controller factory because is conflicts with
+  // CEF's internal handling of "chrome://tracing".
+  content::WebUIControllerFactory::UnregisterFactoryForTesting(
+      content::ContentWebUIControllerFactory::GetInstance());
+}
+
 int CefBrowserMainParts::PreCreateThreads() {
   PlatformInitialize();
   net::NetModule::SetResourceProvider(&ResourceProvider);
diff --git a/libcef/browser/browser_main.h b/libcef/browser/browser_main.h
index 9b060a166..33929eafd 100644
--- a/libcef/browser/browser_main.h
+++ b/libcef/browser/browser_main.h
@@ -38,6 +38,7 @@ class CefBrowserMainParts : public content::BrowserMainParts {
   virtual ~CefBrowserMainParts();
 
   virtual void PreMainMessageLoopStart() OVERRIDE;
+  virtual void PostMainMessageLoopStart() OVERRIDE;
   virtual int PreCreateThreads() OVERRIDE;
   virtual void PreMainMessageLoopRun() OVERRIDE;
   virtual void PostMainMessageLoopRun() OVERRIDE;
diff --git a/libcef/browser/chrome_scheme_handler.cc b/libcef/browser/chrome_scheme_handler.cc
index 78028c925..26e25af1b 100644
--- a/libcef/browser/chrome_scheme_handler.cc
+++ b/libcef/browser/chrome_scheme_handler.cc
@@ -14,6 +14,7 @@
 #include "libcef/browser/context.h"
 #include "libcef/browser/frame_host_impl.h"
 #include "libcef/browser/internal_scheme_handler.h"
+#include "libcef/browser/scheme_impl.h"
 #include "libcef/browser/thread_util.h"
 
 #include "base/command_line.h"
@@ -24,15 +25,18 @@
 #include "base/stringprintf.h"
 #include "base/utf_string_conversions.h"
 #include "base/values.h"
+#include "content/browser/net/view_http_cache_job_factory.h"
+#include "content/browser/net/view_blob_internals_job_factory.h"
 #include "content/public/common/content_client.h"
+#include "content/public/common/url_constants.h"
 #include "grit/cef_resources.h"
 #include "ipc/ipc_channel.h"
+#include "net/url_request/url_request.h"
 #include "v8/include/v8.h"
 #include "webkit/user_agent/user_agent_util.h"
 
 namespace scheme {
 
-const char kChromeScheme[] = "chrome";
 const char kChromeURL[] = "chrome://";
 const char kChromeProcessMessage[] = "chrome.send";
 
@@ -595,11 +599,46 @@ void OnChromeTracingProcessMessage(CefRefPtr<CefBrowser> browser,
   }
 }
 
+// Wrapper for a ChromeProtocolHandler instance from
+// content/browser/webui/url_data_manager_backend.cc. 
+class ChromeProtocolHandlerWrapper :
+    public net::URLRequestJobFactory::ProtocolHandler {
+ public:
+  explicit ChromeProtocolHandlerWrapper(
+      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler> chrome_protocol_handler)
+      : chrome_protocol_handler_(chrome_protocol_handler.Pass()) {
+  }
+
+  virtual net::URLRequestJob* MaybeCreateJob(
+      net::URLRequest* request,
+      net::NetworkDelegate* network_delegate) const OVERRIDE {
+    // Keep synchronized with the checks in ChromeProtocolHandler::MaybeCreateJob.
+    if (content::ViewHttpCacheJobFactory::IsSupportedURL(request->url()) ||
+        (request->url().SchemeIs(chrome::kChromeUIScheme) &&
+         request->url().host() == chrome::kChromeUIAppCacheInternalsHost) ||
+        content::ViewBlobInternalsJobFactory::IsSupportedURL(request->url()) ||
+#if defined(USE_TCMALLOC)
+        (request->url().SchemeIs(chrome::kChromeUIScheme) &&
+         request->url().host() == chrome::kChromeUITcmallocHost) ||
+#endif
+        (request->url().SchemeIs(chrome::kChromeUIScheme) &&
+         request->url().host() == chrome::kChromeUIHistogramHost)) {
+      return chrome_protocol_handler_->MaybeCreateJob(request, network_delegate);
+    }
+
+    // Use the protocol handler registered with CEF.
+    return scheme::GetRequestJob(request, network_delegate);
+  }
+
+ private:
+  scoped_ptr<net::URLRequestJobFactory::ProtocolHandler> chrome_protocol_handler_;
+};
+
 }  // namespace
 
 void RegisterChromeHandler() {
   CefRegisterSchemeHandlerFactory(
-      kChromeScheme,
+      chrome::kChromeUIScheme,
       std::string(),
       CreateInternalHandlerFactory(
           make_scoped_ptr<InternalHandlerDelegate>(new Delegate())));
@@ -650,4 +689,12 @@ void OnChromeProcessMessage(CefRefPtr<CefBrowser> browser,
   }
 }
 
+scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
+WrapChromeProtocolHandler(
+    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
+        chrome_protocol_handler) {
+  return make_scoped_ptr(
+      new ChromeProtocolHandlerWrapper(chrome_protocol_handler.Pass()));
+}
+
 }  // namespace scheme
diff --git a/libcef/browser/chrome_scheme_handler.h b/libcef/browser/chrome_scheme_handler.h
index b63ea6e25..cd339f335 100644
--- a/libcef/browser/chrome_scheme_handler.h
+++ b/libcef/browser/chrome_scheme_handler.h
@@ -7,10 +7,14 @@
 #pragma once
 
 #include <string>
+
 #include "include/cef_browser.h"
 #include "include/cef_frame.h"
 #include "include/cef_process_message.h"
+
+#include "base/memory/scoped_ptr.h"
 #include "googleurl/src/gurl.h"
+#include "net/url_request/url_request_job_factory.h"
 
 namespace base {
 class ListValue;
@@ -22,7 +26,6 @@ class BrowserContext;
 
 namespace scheme {
 
-extern const char kChromeScheme[];
 extern const char kChromeURL[];
 extern const char kChromeProcessMessage[];
 
@@ -41,6 +44,13 @@ void DidFinishChromeLoad(CefRefPtr<CefFrame> frame,
 void OnChromeProcessMessage(CefRefPtr<CefBrowser> browser,
                             const base::ListValue& arguments);
 
+// Create a new ProtocolHandler that will filter the URLs passed to the default
+// "chrome" protocol handler and forward the rest to CEF's handler.
+scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
+WrapChromeProtocolHandler(
+    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
+        chrome_protocol_handler);
+
 }  // namespace scheme
 
 #endif  // CEF_LIBCEF_BROWSER_CHROME_SCHEME_HANDLER_H_
diff --git a/libcef/browser/content_browser_client.cc b/libcef/browser/content_browser_client.cc
index 45466f07a..b33e8c474 100644
--- a/libcef/browser/content_browser_client.cc
+++ b/libcef/browser/content_browser_client.cc
@@ -367,22 +367,10 @@ void CefContentBrowserClient::RenderProcessHostCreated(
 
 net::URLRequestContextGetter* CefContentBrowserClient::CreateRequestContext(
     content::BrowserContext* content_browser_context,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        blob_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        file_system_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        developer_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        chrome_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        chrome_devtools_protocol_handler) {
+    content::ProtocolHandlerMap* protocol_handlers) {
   CefBrowserContext* cef_browser_context =
       CefBrowserContextForBrowserContext(content_browser_context);
-  return cef_browser_context->CreateRequestContext(
-      blob_protocol_handler.Pass(), file_system_protocol_handler.Pass(),
-      developer_protocol_handler.Pass(), chrome_protocol_handler.Pass(),
-      chrome_devtools_protocol_handler.Pass());
+  return cef_browser_context->CreateRequestContext(protocol_handlers);
 }
 
 net::URLRequestContextGetter*
@@ -390,23 +378,11 @@ CefContentBrowserClient::CreateRequestContextForStoragePartition(
     content::BrowserContext* content_browser_context,
     const base::FilePath& partition_path,
     bool in_memory,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        blob_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        file_system_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        developer_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        chrome_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        chrome_devtools_protocol_handler) {
+    content::ProtocolHandlerMap* protocol_handlers) {
   CefBrowserContext* cef_browser_context =
       CefBrowserContextForBrowserContext(content_browser_context);
   return cef_browser_context->CreateRequestContextForStoragePartition(
-      partition_path, in_memory, blob_protocol_handler.Pass(),
-      file_system_protocol_handler.Pass(),
-      developer_protocol_handler.Pass(), chrome_protocol_handler.Pass(),
-      chrome_devtools_protocol_handler.Pass());
+      partition_path, in_memory, protocol_handlers);
 }
 
 void CefContentBrowserClient::AppendExtraCommandLineSwitches(
diff --git a/libcef/browser/content_browser_client.h b/libcef/browser/content_browser_client.h
index 6a891b7d1..8de353ed4 100644
--- a/libcef/browser/content_browser_client.h
+++ b/libcef/browser/content_browser_client.h
@@ -68,30 +68,12 @@ class CefContentBrowserClient : public content::ContentBrowserClient {
       content::RenderProcessHost* host) OVERRIDE;
   virtual net::URLRequestContextGetter* CreateRequestContext(
       content::BrowserContext* browser_context,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          blob_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          file_system_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          developer_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          chrome_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          chrome_devtools_protocol_handler) OVERRIDE;
+      content::ProtocolHandlerMap* protocol_handlers) OVERRIDE;
   virtual net::URLRequestContextGetter* CreateRequestContextForStoragePartition(
       content::BrowserContext* browser_context,
       const base::FilePath& partition_path,
       bool in_memory,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          blob_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          file_system_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          developer_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          chrome_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          chrome_devtools_protocol_handler) OVERRIDE;
+      content::ProtocolHandlerMap* protocol_handlers) OVERRIDE;
   virtual void AppendExtraCommandLineSwitches(CommandLine* command_line,
                                               int child_process_id) OVERRIDE;
   virtual content::QuotaPermissionContext*
diff --git a/libcef/browser/cookie_manager_impl.cc b/libcef/browser/cookie_manager_impl.cc
index e60480e4f..1536e3df8 100644
--- a/libcef/browser/cookie_manager_impl.cc
+++ b/libcef/browser/cookie_manager_impl.cc
@@ -25,6 +25,8 @@
 #include "net/cookies/parsed_cookie.h"
 #include "net/url_request/url_request_context.h"
 
+using content::BrowserThread;
+
 namespace {
 
 // Callback class for visiting cookies.
@@ -286,9 +288,12 @@ bool CefCookieManagerImpl::SetStoragePath(
           file_util::CreateDirectory(new_path)) {
         const base::FilePath& cookie_path = new_path.AppendASCII("Cookies");
         persistent_store =
-            new SQLitePersistentCookieStore(cookie_path,
-                                            persist_session_cookies,
-                                            NULL);
+            new SQLitePersistentCookieStore(
+                cookie_path,
+                BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO),
+                BrowserThread::GetMessageLoopProxyForThread(BrowserThread::DB),
+                persist_session_cookies,
+                NULL);
       } else {
         NOTREACHED() << "The cookie storage directory could not be created";
         storage_path_.clear();
diff --git a/libcef/browser/devtools_delegate.cc b/libcef/browser/devtools_delegate.cc
index a6510c22f..7b56171ce 100644
--- a/libcef/browser/devtools_delegate.cc
+++ b/libcef/browser/devtools_delegate.cc
@@ -19,6 +19,7 @@
 #include "content/public/browser/render_view_host.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/url_constants.h"
 #include "grit/cef_resources.h"
 #include "net/base/tcp_listen_socket.h"
 #include "ui/base/layout.h"
@@ -175,7 +176,8 @@ std::string CefDevToolsDelegate::GetDevToolsURL(content::RenderViewHost* rvh,
   std::string page_id = binding_->GetIdentifier(rvh);
   std::string host = http_scheme ?
       base::StringPrintf("http://localhost:%d/devtools/", port) :
-      scheme::kChromeDevToolsURL;
+      base::StringPrintf("%s://%s/devtools/", chrome::kChromeDevToolsScheme,
+                         scheme::kChromeDevToolsHost);
 
   return base::StringPrintf(
       "%sdevtools.html?ws=localhost:%d/devtools/page/%s",
diff --git a/libcef/browser/devtools_scheme_handler.cc b/libcef/browser/devtools_scheme_handler.cc
index ea8710a10..a5095d69d 100644
--- a/libcef/browser/devtools_scheme_handler.cc
+++ b/libcef/browser/devtools_scheme_handler.cc
@@ -3,16 +3,18 @@
 // be found in the LICENSE file.
 
 #include "libcef/browser/devtools_scheme_handler.h"
+
 #include <string>
+
 #include "libcef/browser/internal_scheme_handler.h"
+
 #include "base/string_util.h"
+#include "content/public/common/url_constants.h"
 #include "grit/devtools_resources_map.h"
 
 namespace scheme {
 
-const char kChromeDevToolsScheme[] = "chrome-devtools";
 const char kChromeDevToolsHost[] = "devtools";
-const char kChromeDevToolsURL[] = "chrome-devtools://devtools/";
 
 namespace {
 
@@ -43,7 +45,7 @@ class Delegate : public InternalHandlerDelegate {
 
 void RegisterChromeDevToolsHandler() {
   CefRegisterSchemeHandlerFactory(
-      kChromeDevToolsScheme,
+      chrome::kChromeDevToolsScheme,
       kChromeDevToolsHost,
       CreateInternalHandlerFactory(
           make_scoped_ptr<InternalHandlerDelegate>(new Delegate())));
diff --git a/libcef/browser/devtools_scheme_handler.h b/libcef/browser/devtools_scheme_handler.h
index 3cc90d74e..57168b17b 100644
--- a/libcef/browser/devtools_scheme_handler.h
+++ b/libcef/browser/devtools_scheme_handler.h
@@ -8,9 +8,7 @@
 
 namespace scheme {
 
-extern const char kChromeDevToolsScheme[];
 extern const char kChromeDevToolsHost[];
-extern const char kChromeDevToolsURL[];
 
 // Register the chrome-devtools scheme handler.
 void RegisterChromeDevToolsHandler();
diff --git a/libcef/browser/proxy_stubs.cc b/libcef/browser/proxy_stubs.cc
index dbc21103a..42c55f0f2 100644
--- a/libcef/browser/proxy_stubs.cc
+++ b/libcef/browser/proxy_stubs.cc
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 #include "base/logging.h"
-#include "chrome/browser/prefs/pref_registry_syncable.h"
+#include "components/user_prefs/pref_registry_syncable.h"
 
 // Required by PrefProxyConfigTrackerImpl::RegisterUserPrefs.
 void PrefRegistrySyncable::RegisterDictionaryPref(
diff --git a/libcef/browser/resource_request_job.cc b/libcef/browser/resource_request_job.cc
index 72266e031..58d8d4c8e 100644
--- a/libcef/browser/resource_request_job.cc
+++ b/libcef/browser/resource_request_job.cc
@@ -376,10 +376,10 @@ void CefResourceRequestJob::AddCookieHeaderAndStart() {
 void CefResourceRequestJob::DoLoadCookies() {
   net::CookieOptions options;
   options.set_include_httponly();
-  request_->context()->cookie_store()->GetCookiesWithInfoAsync(
+  request_->context()->cookie_store()->GetCookiesWithOptionsAsync(
       request_->url(), options,
       base::Bind(&CefResourceRequestJob::OnCookiesLoaded,
-                  weak_factory_.GetWeakPtr()));
+                 weak_factory_.GetWeakPtr()));
 }
 
 void CefResourceRequestJob::CheckCookiePolicyAndLoad(
@@ -403,9 +403,7 @@ void CefResourceRequestJob::CheckCookiePolicyAndLoad(
     DoStartTransaction();
 }
 
-void CefResourceRequestJob::OnCookiesLoaded(
-    const std::string& cookie_line,
-    const std::vector<net::CookieStore::CookieInfo>& cookie_infos) {
+void CefResourceRequestJob::OnCookiesLoaded(const std::string& cookie_line) {
   if (!cookie_line.empty()) {
     CefRequest::HeaderMap headerMap;
     cef_request_->GetHeaderMap(headerMap);
diff --git a/libcef/browser/resource_request_job.h b/libcef/browser/resource_request_job.h
index 8c7a7f6d9..c2b8e086c 100644
--- a/libcef/browser/resource_request_job.h
+++ b/libcef/browser/resource_request_job.h
@@ -47,9 +47,7 @@ class CefResourceRequestJob : public net::URLRequestJob {
   void AddCookieHeaderAndStart();
   void DoLoadCookies();
   void CheckCookiePolicyAndLoad(const net::CookieList& cookie_list);
-  void OnCookiesLoaded(
-      const std::string& cookie_line,
-      const std::vector<net::CookieStore::CookieInfo>& cookie_infos);
+  void OnCookiesLoaded(const std::string& cookie_line);
   void DoStartTransaction();
   void StartTransaction();
 
diff --git a/libcef/browser/scheme_impl.cc b/libcef/browser/scheme_impl.cc
index 371fa6c69..cc7e25084 100644
--- a/libcef/browser/scheme_impl.cc
+++ b/libcef/browser/scheme_impl.cc
@@ -124,11 +124,6 @@ class CefUrlRequestManager {
   // Retrieve the singleton instance.
   static CefUrlRequestManager* GetInstance();
 
-  net::URLRequestJobFactoryImpl* GetJobFactoryImpl() {
-    return static_cast<CefURLRequestContextGetter*>(
-        _Context->request_context().get())->job_factory_impl();
-  }
-
   bool AddFactory(const std::string& scheme,
                   const std::string& domain,
                   CefRefPtr<CefSchemeHandlerFactory> factory) {
@@ -146,11 +141,9 @@ class CefUrlRequestManager {
     if (!IsStandardScheme(scheme_lower))
       domain_lower.clear();
 
-    handler_map_[make_pair(scheme_lower, domain_lower)] = factory;
+    SetProtocolHandlerIfNecessary(scheme_lower, true);
 
-    net::URLRequestJobFactoryImpl* job_factory = GetJobFactoryImpl();
-    job_factory->SetProtocolHandler(scheme_lower,
-                                    new ProtocolHandler(scheme_lower));
+    handler_map_[make_pair(scheme_lower, domain_lower)] = factory;
 
     return true;
   }
@@ -168,8 +161,11 @@ class CefUrlRequestManager {
 
     HandlerMap::iterator iter =
         handler_map_.find(make_pair(scheme_lower, domain_lower));
-    if (iter != handler_map_.end())
+    if (iter != handler_map_.end()) {
       handler_map_.erase(iter);
+
+      SetProtocolHandlerIfNecessary(scheme_lower, false);
+    }
   }
 
   // Clear all the existing URL handlers and unregister the ProtocolFactory.
@@ -178,21 +174,68 @@ class CefUrlRequestManager {
 
     net::URLRequestJobFactoryImpl* job_factory = GetJobFactoryImpl();
 
-    // Unregister with the ProtocolFactory.
+    // Create a unique set of scheme names.
     std::set<std::string> schemes;
     for (HandlerMap::const_iterator i = handler_map_.begin();
         i != handler_map_.end(); ++i) {
       schemes.insert(i->first.first);
     }
+
     for (std::set<std::string>::const_iterator scheme = schemes.begin();
         scheme != schemes.end(); ++scheme) {
-      job_factory->SetProtocolHandler(*scheme, NULL);
+      const std::string& scheme_name = *scheme;
+      if (!scheme::IsInternalProtectedScheme(scheme_name)) {
+        bool set_protocol = job_factory->SetProtocolHandler(scheme_name, NULL);
+        DCHECK(set_protocol);
+      }
     }
 
     handler_map_.clear();
   }
 
+  // Helper for chaining ProtocolHandler implementations.
+  net::URLRequestJob* GetRequestJob(net::URLRequest* request,
+                                    net::NetworkDelegate* network_delegate) {
+    CEF_REQUIRE_IOT();
+    return GetRequestJob(request, network_delegate, request->url().scheme());
+  }
+
  private:
+  net::URLRequestJobFactoryImpl* GetJobFactoryImpl() {
+    return static_cast<CefURLRequestContextGetter*>(
+        _Context->request_context().get())->job_factory_impl();
+  }
+
+  // Add or remove the protocol handler if necessary. |scheme| will already be
+  // in lower case.
+  void SetProtocolHandlerIfNecessary(const std::string& scheme, bool add) {
+    // Don't modify a protocol handler for internal protected schemes or if the
+    // protocol handler is still needed by other registered factories.
+    if (scheme::IsInternalProtectedScheme(scheme) || HasFactory(scheme))
+      return;
+
+    net::URLRequestJobFactoryImpl* job_factory = GetJobFactoryImpl();
+    bool set_protocol = job_factory->SetProtocolHandler(
+        scheme,
+        (add ? new ProtocolHandler(scheme) : NULL));
+    DCHECK(set_protocol);
+  }
+
+  // Returns true if any factory currently exists for |scheme|. |scheme| will
+  // already be in lower case.
+  bool HasFactory(const std::string& scheme) {
+    if (handler_map_.empty())
+      return false;
+
+    for (HandlerMap::const_iterator i = handler_map_.begin();
+        i != handler_map_.end(); ++i) {
+      if (scheme == i->first.first)
+        return true;
+    }
+
+    return false;
+  }
+
   // Retrieve the matching handler factory, if any. |scheme| will already be in
   // lower case.
   CefRefPtr<CefSchemeHandlerFactory> GetHandlerFactory(
@@ -313,3 +356,13 @@ bool CefClearSchemeHandlerFactories() {
 
   return true;
 }
+
+namespace scheme {
+
+net::URLRequestJob* GetRequestJob(net::URLRequest* request,
+                                  net::NetworkDelegate* network_delegate) {
+  return CefUrlRequestManager::GetInstance()->GetRequestJob(
+      request, network_delegate);
+}
+
+}  // namespace scheme
diff --git a/libcef/browser/scheme_impl.h b/libcef/browser/scheme_impl.h
new file mode 100644
index 000000000..5b66ef9a1
--- /dev/null
+++ b/libcef/browser/scheme_impl.h
@@ -0,0 +1,24 @@
+// Copyright (c) 2013 The Chromium Embedded Framework Authors. All rights
+// reserved. Use of this source code is governed by a BSD-style license that
+// can be found in the LICENSE file.
+
+#ifndef CEF_LIBCEF_BROWSER_SCHEME_IMPL_H_
+#define CEF_LIBCEF_BROWSER_SCHEME_IMPL_H_
+#pragma once
+
+namespace net {
+class NetworkDelegate;
+class URLRequest;
+class URLRequestJob;
+}
+
+namespace scheme {
+
+// Helper for chaining net::URLRequestJobFactory::ProtocolHandler
+// implementations.
+net::URLRequestJob* GetRequestJob(net::URLRequest* request,
+                                  net::NetworkDelegate* network_delegate);
+
+}  // namespace scheme
+
+#endif  // CEF_LIBCEF_BROWSER_SCHEME_IMPL_H_
diff --git a/libcef/browser/scheme_registration.cc b/libcef/browser/scheme_registration.cc
index 5621f6bb1..f66b29b27 100644
--- a/libcef/browser/scheme_registration.cc
+++ b/libcef/browser/scheme_registration.cc
@@ -7,16 +7,19 @@
 #include "libcef/browser/devtools_scheme_handler.h"
 #include "libcef/renderer/content_renderer_client.h"
 
+#include "content/public/common/url_constants.h"
+#include "net/url_request/url_request_job_factory_impl.h"
+
 namespace scheme {
 
-void AddStandardSchemes(std::vector<std::string>* standard_schemes) {
+void AddInternalStandardSchemes(std::vector<std::string>* standard_schemes) {
   static struct {
     const char* name;
     bool is_local;
     bool is_display_isolated;
   } schemes[] = {
-    { scheme::kChromeScheme,          true,  true  },
-    { scheme::kChromeDevToolsScheme,  true,  false }
+    { chrome::kChromeUIScheme,        true,  true  },
+    { chrome::kChromeDevToolsScheme,  true,  false }
   };
 
   for (size_t i = 0; i < sizeof(schemes) / sizeof(schemes[0]); ++i)
@@ -31,13 +34,64 @@ void AddStandardSchemes(std::vector<std::string>* standard_schemes) {
   }
 }
 
+bool IsInternalProtectedScheme(const std::string& scheme) {
+  // These values originate from StoragePartitionImplMap::Get() in
+  // content/browser/storage_partition_impl_map.cc and are modified by
+  // InstallInternalHandlers().
+  static const char* schemes[] = {
+    chrome::kBlobScheme,
+    chrome::kChromeUIScheme,
+    chrome::kFileSystemScheme,
+  };
+
+  for (size_t i = 0; i < sizeof(schemes) / sizeof(schemes[0]); ++i) {
+    if (scheme == schemes[i])
+      return true;
+  }
+
+  return false;
+}
+
+void InstallInternalProtectedHandlers(
+    net::URLRequestJobFactoryImpl* job_factory,
+    content::ProtocolHandlerMap* protocol_handlers) {
+  for (content::ProtocolHandlerMap::iterator it =
+           protocol_handlers->begin();
+       it != protocol_handlers->end();
+       ++it) {
+    const std::string& scheme = it->first;
+    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler> protocol_handler;
+
+    if (scheme == chrome::kChromeDevToolsScheme) {
+      // Don't use the default "chrome-devtools" handler.
+      continue;
+    } else if (scheme == chrome::kChromeUIScheme) {
+      // Filter the URLs that are passed to the default "chrome" handler so as
+      // not to interfere with CEF's "chrome" handler.
+      protocol_handler.reset(
+          scheme::WrapChromeProtocolHandler(
+              make_scoped_ptr(it->second.release())).release());
+    } else {
+      protocol_handler.reset(it->second.release());
+    }
+
+    // Make sure IsInternalScheme() stays synchronized with what Chromium is
+    // actually giving us.
+    DCHECK(IsInternalProtectedScheme(scheme));
+
+    bool set_protocol = job_factory->SetProtocolHandler(
+        scheme, protocol_handler.release());
+    DCHECK(set_protocol);
+  }
+}
+
 void RegisterInternalHandlers() {
   scheme::RegisterChromeHandler();
   scheme::RegisterChromeDevToolsHandler();
 }
 
 void DidFinishLoad(CefRefPtr<CefFrame> frame, const GURL& validated_url) {
-  if (validated_url.scheme() == scheme::kChromeScheme)
+  if (validated_url.scheme() == chrome::kChromeUIScheme)
     scheme::DidFinishChromeLoad(frame, validated_url);
 }
 
diff --git a/libcef/browser/scheme_registration.h b/libcef/browser/scheme_registration.h
index 07d893262..43f47508d 100644
--- a/libcef/browser/scheme_registration.h
+++ b/libcef/browser/scheme_registration.h
@@ -2,21 +2,41 @@
 // reserved. Use of this source code is governed by a BSD-style license that
 // can be found in the LICENSE file.
 
-#ifndef CEF_LIBCEF_BROWSER_SCHEME_IMPL_H_
-#define CEF_LIBCEF_BROWSER_SCHEME_IMPL_H_
+#ifndef CEF_LIBCEF_BROWSER_SCHEME_REGISTRATION_H_
+#define CEF_LIBCEF_BROWSER_SCHEME_REGISTRATION_H_
 #pragma once
 
 #include <string>
 #include <vector>
+
 #include "include/cef_frame.h"
+
+#include "content/public/browser/content_browser_client.h"
 #include "googleurl/src/gurl.h"
 
+namespace net {
+class URLRequestJobFactoryImpl;
+}
+
 namespace scheme {
 
-// Add all standard schemes.
-void AddStandardSchemes(std::vector<std::string>* standard_schemes);
+// Add internal standard schemes.
+void AddInternalStandardSchemes(std::vector<std::string>* standard_schemes);
 
-// Register all internal scheme handlers.
+// Returns true if the specified |scheme| is handled internally and should not
+// be explicitly registered or unregistered with the URLRequestJobFactory. A
+// registered handler for one of these schemes (like "chrome") may still be
+// triggered via chaining from an existing ProtocolHandler. |scheme| should
+// always be a lower-case string.
+bool IsInternalProtectedScheme(const std::string& scheme);
+
+// Install the internal scheme handlers provided by Chromium that cannot be
+// overridden.
+void InstallInternalProtectedHandlers(
+    net::URLRequestJobFactoryImpl* job_factory,
+    content::ProtocolHandlerMap* protocol_handlers);
+
+// Register the internal scheme handlers that can be overridden.
 void RegisterInternalHandlers();
 
 // Used to fire any asynchronous content updates.
@@ -24,4 +44,4 @@ void DidFinishLoad(CefRefPtr<CefFrame> frame, const GURL& validated_url);
 
 }  // namespace scheme
 
-#endif  // CEF_LIBCEF_BROWSER_SCHEME_IMPL_H_
+#endif  // CEF_LIBCEF_BROWSER_SCHEME_REGISTRATION_H_
diff --git a/libcef/browser/url_request_context_getter.cc b/libcef/browser/url_request_context_getter.cc
index 1de639b26..1b9eade3d 100644
--- a/libcef/browser/url_request_context_getter.cc
+++ b/libcef/browser/url_request_context_getter.cc
@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "libcef/browser/context.h"
+#include "libcef/browser/scheme_registration.h"
 #include "libcef/browser/thread_util.h"
 #include "libcef/browser/url_network_delegate.h"
 #include "libcef/browser/url_request_context_proxy.h"
@@ -21,7 +22,6 @@
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
-#include "base/string_split.h"
 #include "base/string_util.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/threading/worker_pool.h"
@@ -41,7 +41,6 @@
 #include "net/http/http_cache.h"
 #include "net/http/http_server_properties_impl.h"
 #include "net/proxy/proxy_service.h"
-#include "net/url_request/protocol_intercept_job_factory.h"
 #include "net/url_request/static_http_user_agent_settings.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_context.h"
@@ -58,19 +57,13 @@ using content::BrowserThread;
 CefURLRequestContextGetter::CefURLRequestContextGetter(
     MessageLoop* io_loop,
     MessageLoop* file_loop,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        blob_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        file_system_protocol_handler,
-    scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-        developer_protocol_handler)
+    content::ProtocolHandlerMap* protocol_handlers)
     : io_loop_(io_loop),
-      file_loop_(file_loop),
-      blob_protocol_handler_(blob_protocol_handler.Pass()),
-      file_system_protocol_handler_(file_system_protocol_handler.Pass()),
-      developer_protocol_handler_(developer_protocol_handler.Pass()) {
+      file_loop_(file_loop) {
   // Must first be created on the UI thread.
   CEF_REQUIRE_UIT();
+
+  std::swap(protocol_handlers_, *protocol_handlers);
 }
 
 CefURLRequestContextGetter::~CefURLRequestContextGetter() {
@@ -176,15 +169,12 @@ net::URLRequestContext* CefURLRequestContextGetter::GetURLRequestContext() {
     scoped_ptr<net::URLRequestJobFactoryImpl> job_factory(
         new net::URLRequestJobFactoryImpl());
     job_factory_impl_ = job_factory.get();
-    bool set_protocol = job_factory->SetProtocolHandler(
-        chrome::kBlobScheme, blob_protocol_handler_.release());
-    DCHECK(set_protocol);
-    set_protocol = job_factory->SetProtocolHandler(
-        chrome::kFileSystemScheme, file_system_protocol_handler_.release());
-    DCHECK(set_protocol);
-    storage_->set_job_factory(new net::ProtocolInterceptJobFactory(
-        job_factory.PassAs<net::URLRequestJobFactory>(),
-        developer_protocol_handler_.Pass()));
+
+    scheme::InstallInternalProtectedHandlers(job_factory.get(),
+                                             &protocol_handlers_);
+    protocol_handlers_.clear();
+
+    storage_->set_job_factory(job_factory.release());
 
     request_interceptor_.reset(new CefRequestInterceptor);
   }
@@ -222,9 +212,12 @@ void CefURLRequestContextGetter::SetCookieStoragePath(
         file_util::CreateDirectory(path)) {
       const base::FilePath& cookie_path = path.AppendASCII("Cookies");
       persistent_store =
-          new SQLitePersistentCookieStore(cookie_path,
-                                          persist_session_cookies,
-                                          NULL);
+          new SQLitePersistentCookieStore(
+              cookie_path,
+              BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO),
+              BrowserThread::GetMessageLoopProxyForThread(BrowserThread::DB),
+              persist_session_cookies,
+              NULL);
     } else {
       NOTREACHED() << "The cookie storage directory could not be created";
     }
diff --git a/libcef/browser/url_request_context_getter.h b/libcef/browser/url_request_context_getter.h
index bc3765a34..53ab23232 100644
--- a/libcef/browser/url_request_context_getter.h
+++ b/libcef/browser/url_request_context_getter.h
@@ -14,6 +14,7 @@
 #include "base/files/file_path.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
+#include "content/public/browser/content_browser_client.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "net/url_request/url_request_job_factory.h"
 
@@ -76,12 +77,7 @@ class CefURLRequestContextGetter : public net::URLRequestContextGetter {
   CefURLRequestContextGetter(
       MessageLoop* io_loop,
       MessageLoop* file_loop,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          blob_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          file_system_protocol_handler,
-      scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-          developer_protocol_handler);
+      content::ProtocolHandlerMap* protocol_handlers);
   virtual ~CefURLRequestContextGetter();
 
   // net::URLRequestContextGetter implementation.
@@ -115,12 +111,7 @@ class CefURLRequestContextGetter : public net::URLRequestContextGetter {
   scoped_ptr<net::URLRequestContextStorage> storage_;
   scoped_ptr<net::URLRequestContext> url_request_context_;
   scoped_ptr<net::URLSecurityManager> url_security_manager_;
-  scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-      blob_protocol_handler_;
-  scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-      file_system_protocol_handler_;
-  scoped_ptr<net::URLRequestJobFactory::ProtocolHandler>
-      developer_protocol_handler_;
+  content::ProtocolHandlerMap protocol_handlers_;
   net::URLRequestJobFactoryImpl* job_factory_impl_;
 
   typedef std::set<CefURLRequestContextProxy*> RequestContextProxySet;
diff --git a/libcef/browser/url_request_context_proxy.cc b/libcef/browser/url_request_context_proxy.cc
index e18c0353f..1a2c89cd2 100644
--- a/libcef/browser/url_request_context_proxy.cc
+++ b/libcef/browser/url_request_context_proxy.cc
@@ -46,14 +46,6 @@ class CefCookieStoreProxy : public net::CookieStore {
     cookie_store->GetCookiesWithOptionsAsync(url, options, callback);
   }
 
-  void GetCookiesWithInfoAsync(
-      const GURL& url,
-      const net::CookieOptions& options,
-      const GetCookieInfoCallback& callback) OVERRIDE {
-    scoped_refptr<net::CookieStore> cookie_store = GetCookieStore();
-    cookie_store->GetCookiesWithInfoAsync(url, options, callback);
-  }
-
   virtual void DeleteCookieAsync(const GURL& url,
                                  const std::string& cookie_name,
                                  const base::Closure& callback) OVERRIDE {
diff --git a/libcef/common/content_client.cc b/libcef/common/content_client.cc
index 0d2aa53d4..c021c85d3 100644
--- a/libcef/common/content_client.cc
+++ b/libcef/common/content_client.cc
@@ -53,7 +53,7 @@ void CefContentClient::AddAdditionalSchemes(
     DCHECK(schemeRegistrar->VerifyRefCount());
   }
 
-  scheme::AddStandardSchemes(standard_schemes);
+  scheme::AddInternalStandardSchemes(standard_schemes);
 }
 
 std::string CefContentClient::GetUserAgent() const {
diff --git a/libcef/common/values_impl.cc b/libcef/common/values_impl.cc
index 92432183a..6840b7107 100644
--- a/libcef/common/values_impl.cc
+++ b/libcef/common/values_impl.cc
@@ -227,9 +227,8 @@ bool CefDictionaryValueImpl::HasKey(const CefString& key) {
 bool CefDictionaryValueImpl::GetKeys(KeyList& keys) {
   CEF_VALUE_VERIFY_RETURN(false, 0);
 
-  base::DictionaryValue::key_iterator it = const_value().begin_keys();
-  for (; it != const_value().end_keys(); ++it)
-    keys.push_back(*it);
+  for (DictionaryValue::Iterator i(const_value()); !i.IsAtEnd(); i.Advance())
+    keys.push_back(i.key());
 
   return true;
 }
diff --git a/libcef/renderer/chrome_bindings.cc b/libcef/renderer/chrome_bindings.cc
index c759d2b96..73e33dff5 100644
--- a/libcef/renderer/chrome_bindings.cc
+++ b/libcef/renderer/chrome_bindings.cc
@@ -4,9 +4,12 @@
 
 #include "libcef/renderer/chrome_bindings.h"
 #include "libcef/renderer/browser_impl.h"
+
 #include <string>
+
 #include "base/logging.h"
 #include "base/values.h"
+#include "content/public/common/url_constants.h"
 
 namespace scheme {
 
@@ -93,7 +96,7 @@ void OnContextCreated(CefRefPtr<CefBrowserImpl> browser,
                       CefRefPtr<CefFrameImpl> frame,
                       CefRefPtr<CefV8Context> context) {
   GURL url = GURL(frame->GetURL().ToString());
-  if (url.scheme() != kChromeScheme)
+  if (url.scheme() != chrome::kChromeUIScheme)
     return;
 
   CefRefPtr<CefV8Value> global = context->GetGlobal();
diff --git a/libcef/renderer/chrome_bindings.h b/libcef/renderer/chrome_bindings.h
index 482bac467..b62d458fd 100644
--- a/libcef/renderer/chrome_bindings.h
+++ b/libcef/renderer/chrome_bindings.h
@@ -12,7 +12,6 @@
 
 namespace scheme {
 
-extern const char kChromeScheme[];
 extern const char kChromeProcessMessage[];
 
 void OnContextCreated(CefRefPtr<CefBrowserImpl> browser,
diff --git a/libcef/renderer/content_renderer_client.cc b/libcef/renderer/content_renderer_client.cc
index 00e64a683..4fd2521e6 100644
--- a/libcef/renderer/content_renderer_client.cc
+++ b/libcef/renderer/content_renderer_client.cc
@@ -40,13 +40,13 @@ MSVC_POP_WARNING();
 #include "third_party/WebKit/Source/Platform/chromium/public/WebPrerenderingSupport.h"
 #include "third_party/WebKit/Source/Platform/chromium/public/WebString.h"
 #include "third_party/WebKit/Source/Platform/chromium/public/WebURL.h"
+#include "third_party/WebKit/Source/Platform/chromium/public/WebWorkerRunLoop.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFrame.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPrerendererClient.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebRuntimeFeatures.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityPolicy.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebView.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebWorkerInfo.h"
-#include "third_party/WebKit/Source/WebKit/chromium/public/WebWorkerRunLoop.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebWorkerScriptObserver.h"
 #include "v8/include/v8.h"
 #include "webkit/glue/worker_task_runner.h"
diff --git a/libcef/renderer/v8_impl.cc b/libcef/renderer/v8_impl.cc
index 8394252b0..5288bddc1 100644
--- a/libcef/renderer/v8_impl.cc
+++ b/libcef/renderer/v8_impl.cc
@@ -79,6 +79,7 @@ class CefV8IsolateManager {
   scoped_refptr<CefV8ContextState> GetContextState(
       v8::Handle<v8::Context> context) {
     DCHECK_EQ(isolate_, v8::Isolate::GetCurrent());
+    DCHECK(context.IsEmpty() || isolate_ == context->GetIsolate());
 
     if (context_safety_impl_ == IMPL_DISABLED)
       return scoped_refptr<CefV8ContextState>();
@@ -103,7 +104,9 @@ class CefV8IsolateManager {
     } else {
       if (context_state_key_.IsEmpty()) {
         context_state_key_ =
-            v8::Persistent<v8::String>::New(v8::String::New(kCefContextState));
+            v8::Persistent<v8::String>::New(
+                isolate_,
+                v8::String::New(kCefContextState));
       }
 
       v8::Handle<v8::Object> object = context->Global();
@@ -184,6 +187,7 @@ class CefV8IsolateManager {
     worker_url_ = worker_url;
   }
 
+  v8::Isolate* isolate() const { return isolate_; }
   scoped_refptr<base::SequencedTaskRunner> task_runner() const {
     return task_runner_;
   }
@@ -397,11 +401,13 @@ class CefV8MakeWeakParam {
 };
 
 // Callback for weak persistent reference destruction.
-void TrackDestructor(v8::Persistent<v8::Value> object, void* parameter) {
+void TrackDestructor(v8::Isolate* isolate,
+                     v8::Persistent<v8::Value> object,
+                     void* parameter) {
   if (parameter)
     delete static_cast<CefV8MakeWeakParam*>(parameter);
 
-  object.Dispose();
+  object.Dispose(isolate);
   object.Clear();
 }
 
@@ -817,6 +823,8 @@ bool CefV8HandleBase::BelongsToCurrentThread() const {
 CefV8HandleBase::CefV8HandleBase(v8::Handle<v8::Context> context) {
   CefV8IsolateManager* manager = GetIsolateManager();
   DCHECK(manager);
+
+  isolate_ = manager->isolate();
   task_runner_ = manager->task_runner();
   context_state_ = manager->GetContextState(context);
 }
@@ -1011,17 +1019,17 @@ WebKit::WebFrame* CefV8ContextImpl::GetWebFrame() {
 // CefV8ValueImpl::Handle
 
 CefV8ValueImpl::Handle::~Handle() {
-  // Persist the |tracker_| object (call MakeWeak) if:
-  // A. The value represents an Object or Function, and
-  // B. The handle has been passed into a V8 function or used as a return value
+  // Persist the handle (call MakeWeak) if:
+  // A. The handle has been passed into a V8 function or used as a return value
   //    from a V8 callback, and
-  // C. The associated context, if any, is still valid.
-  if (tracker_ && tracker_should_persist_ &&
-      (!context_state_.get() || context_state_->IsValid())) {
-    handle_.MakeWeak(new CefV8MakeWeakParam(context_state_, tracker_),
-                     TrackDestructor);
+  // B. The associated context, if any, is still valid.
+  if (should_persist_ && (!context_state_.get() || context_state_->IsValid())) {
+    handle_.MakeWeak(
+        isolate(),
+        (tracker_ ? new CefV8MakeWeakParam(context_state_, tracker_) : NULL),
+        TrackDestructor);
   } else {
-    handle_.Dispose();
+    handle_.Dispose(isolate());
     handle_.Clear();
 
     if (tracker_)
diff --git a/libcef/renderer/v8_impl.h b/libcef/renderer/v8_impl.h
index 5f9aa0b3d..b71ba39e4 100644
--- a/libcef/renderer/v8_impl.h
+++ b/libcef/renderer/v8_impl.h
@@ -102,6 +102,7 @@ class CefV8HandleBase :
 
   bool BelongsToCurrentThread() const;
 
+  v8::Isolate* isolate() const { return isolate_; }
   scoped_refptr<base::SequencedTaskRunner> task_runner() const {
     return task_runner_;
   }
@@ -112,6 +113,7 @@ class CefV8HandleBase :
   explicit CefV8HandleBase(v8::Handle<v8::Context> context);
 
  protected:
+  v8::Isolate* isolate_;
   scoped_refptr<base::SequencedTaskRunner> task_runner_;
   scoped_refptr<CefV8ContextState> context_state_;
 };
@@ -126,10 +128,10 @@ class CefV8Handle : public CefV8HandleBase {
 
   CefV8Handle(v8::Handle<v8::Context> context, handleType v)
       : CefV8HandleBase(context),
-        handle_(persistentType::New(v)) {
+        handle_(persistentType::New(isolate(), v)) {
   }
   virtual ~CefV8Handle() {
-    handle_.Dispose();
+    handle_.Dispose(isolate());
     handle_.Clear();
   }
 
@@ -258,16 +260,16 @@ class CefV8ValueImpl : public CefV8Value {
 
     Handle(v8::Handle<v8::Context> context, handleType v, CefTrackNode* tracker)
         : CefV8HandleBase(context),
-          handle_(persistentType::New(v)),
+          handle_(persistentType::New(isolate(), v)),
           tracker_(tracker),
-          tracker_should_persist_(false) {
+          should_persist_(false) {
     }
     virtual ~Handle();
 
     handleType GetHandle(bool should_persist) {
       DCHECK(IsValid());
-      if (should_persist && tracker_ && !tracker_should_persist_)
-        tracker_should_persist_ = true;
+      if (should_persist && !should_persist_)
+        should_persist_ = true;
       return handle_;
     }
 
@@ -278,9 +280,8 @@ class CefV8ValueImpl : public CefV8Value {
     // internal data or function handler objects that are reference counted.
     CefTrackNode* tracker_;
 
-    // True if the |tracker_| object needs to persist due to an Object or
-    // Function type being passed into V8.
-    bool tracker_should_persist_;
+    // True if the handle needs to persist due to it being passed into V8.
+    bool should_persist_;
 
     DISALLOW_COPY_AND_ASSIGN(Handle);
   };
diff --git a/patch/patches/webkit_451.patch b/patch/patches/webkit_451.patch
index 340d3db89..bb371c50f 100644
--- a/patch/patches/webkit_451.patch
+++ b/patch/patches/webkit_451.patch
@@ -61,9 +61,9 @@ Added: svn:eol-style
 
 Index: WebCore/bindings/v8/WorkerScriptController.cpp
 ===================================================================
---- WebCore/bindings/v8/WorkerScriptController.cpp	(revision 142426)
+--- WebCore/bindings/v8/WorkerScriptController.cpp	(revision 145278)
 +++ WebCore/bindings/v8/WorkerScriptController.cpp	(working copy)
-@@ -50,11 +50,23 @@
+@@ -51,11 +51,23 @@
  
  #if PLATFORM(CHROMIUM)
  #include <public/Platform.h>
@@ -87,7 +87,7 @@ Index: WebCore/bindings/v8/WorkerScriptController.cpp
  WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
      : m_workerContext(workerContext)
      , m_isolate(v8::Isolate::New())
-@@ -72,6 +84,8 @@
+@@ -73,6 +85,8 @@
  WorkerScriptController::~WorkerScriptController()
  {
      m_domDataStore.clear();
@@ -96,7 +96,7 @@ Index: WebCore/bindings/v8/WorkerScriptController.cpp
  #if PLATFORM(CHROMIUM)
      // The corresponding call to didStartWorkerRunLoop is in
      // WorkerThread::workerThread().
-@@ -133,6 +147,8 @@
+@@ -134,6 +148,8 @@
      v8::Handle<v8::Object> globalObject = v8::Handle<v8::Object>::Cast(m_context->Global()->GetPrototype());
      globalObject->SetPrototype(jsWorkerContext);
  
@@ -105,7 +105,7 @@ Index: WebCore/bindings/v8/WorkerScriptController.cpp
      return true;
  }
  
-@@ -257,6 +273,39 @@
+@@ -258,6 +274,39 @@
      return workerContext->script();
  }
  
@@ -147,7 +147,7 @@ Index: WebCore/bindings/v8/WorkerScriptController.cpp
  #endif // ENABLE(WORKERS)
 Index: WebCore/bindings/v8/WorkerScriptController.h
 ===================================================================
---- WebCore/bindings/v8/WorkerScriptController.h	(revision 142426)
+--- WebCore/bindings/v8/WorkerScriptController.h	(revision 145278)
 +++ WebCore/bindings/v8/WorkerScriptController.h	(working copy)
 @@ -40,6 +40,10 @@
  #include <wtf/Threading.h>
@@ -180,7 +180,7 @@ Index: WebCore/bindings/v8/WorkerScriptController.h
          ScopedPersistent<v8::Context> m_context;
 Index: WebKit/chromium/public/WebWorkerInfo.h
 ===================================================================
---- WebKit/chromium/public/WebWorkerInfo.h	(revision 142426)
+--- WebKit/chromium/public/WebWorkerInfo.h	(revision 145278)
 +++ WebKit/chromium/public/WebWorkerInfo.h	(working copy)
 @@ -35,9 +35,15 @@
  
@@ -236,7 +236,7 @@ Added: svn:eol-style
 
 Index: WebKit/chromium/src/WebWorkerInfo.cpp
 ===================================================================
---- WebKit/chromium/src/WebWorkerInfo.cpp	(revision 142426)
+--- WebKit/chromium/src/WebWorkerInfo.cpp	(revision 145278)
 +++ WebKit/chromium/src/WebWorkerInfo.cpp	(working copy)
 @@ -31,6 +31,7 @@
  #include "config.h"
diff --git a/patch/patches/webkit_features.patch b/patch/patches/webkit_features.patch
index c37844ea8..a2195a380 100644
--- a/patch/patches/webkit_features.patch
+++ b/patch/patches/webkit_features.patch
@@ -1,8 +1,8 @@
 Index: features.gypi
 ===================================================================
---- features.gypi	(revision 143980)
+--- features.gypi	(revision 145278)
 +++ features.gypi	(working copy)
-@@ -190,7 +190,7 @@
+@@ -193,7 +193,7 @@
            'ENABLE_CALENDAR_PICKER=1',
            'ENABLE_DATALIST_ELEMENT=1',
            'ENABLE_INPUT_SPEECH=1',
@@ -11,7 +11,7 @@ Index: features.gypi
            'ENABLE_INPUT_TYPE_WEEK=1',
            'ENABLE_INPUT_MULTIPLE_FIELDS_UI=1',
            'ENABLE_LEGACY_NOTIFICATIONS=1',
-@@ -199,7 +199,7 @@
+@@ -202,7 +202,7 @@
            'ENABLE_NOTIFICATIONS=1',
            'ENABLE_ORIENTATION_EVENTS=0',
            'ENABLE_PAGE_POPUP=1',
diff --git a/tests/unittests/v8_unittest.cc b/tests/unittests/v8_unittest.cc
index 2232de0d9..56305226b 100644
--- a/tests/unittests/v8_unittest.cc
+++ b/tests/unittests/v8_unittest.cc
@@ -31,6 +31,7 @@ const char kV8WorkerParentTestUrl[] = "http://tests/V8Test.WorkerParent";
 const char kV8WorkerTestUrl[] = "http://tests/V8Test.Worker.js";
 const char kV8TestMsg[] = "V8Test.Test";
 const char kV8TestCmdArg[] = "v8-test";
+const char kV8RunTestMsg[] = "V8Test.RunTest";
 const char kV8DevToolsURLMsg[] = "V8Test.DevToolsURL";
 const char kV8DevToolsLoadHookMsg[] = "V8Test.DevToolsLoadHook";
 
@@ -1585,7 +1586,7 @@ class V8RendererTest : public ClientApp::RenderDelegate {
     test_context_ =
         browser_->GetMainFrame()->GetV8Context();
     browser_->GetMainFrame()->ExecuteJavaScript(
-        "window.setTimeout(test, 0)", "about:blank", 0);
+        "window.setTimeout(test, 0)", browser_->GetMainFrame()->GetURL(), 0);
   }
 
   void RunOnUncaughtExceptionDevToolsTest() {
@@ -1595,7 +1596,8 @@ class V8RendererTest : public ClientApp::RenderDelegate {
     // Show DevTools.
     EXPECT_FALSE(devtools_url_.empty());
     browser_->GetMainFrame()->ExecuteJavaScript(
-        "window.open('" + devtools_url_ + "');", "about:blank", 0);
+        "window.open('" + devtools_url_ + "');",
+        browser_->GetMainFrame()->GetURL(), 0);
   }
 
   // Test execution of a native function when the extension is loaded.
@@ -1719,13 +1721,6 @@ class V8RendererTest : public ClientApp::RenderDelegate {
           CefV8Value::CreateInt(12),
           V8_PROPERTY_ATTRIBUTE_NONE));
     }
-
-    if (test_mode_ > V8TEST_NONE && url != kV8NavTestUrl &&
-        url.find("http://tests/") != std::string::npos) {
-      // Run the test asynchronously.
-      CefPostTask(TID_RENDERER,
-                  NewCefRunnableMethod(this, &V8RendererTest::RunTest));
-    }
   }
 
   virtual void OnContextReleased(CefRefPtr<ClientApp> app,
@@ -2013,6 +2008,11 @@ class V8RendererTest : public ClientApp::RenderDelegate {
         return false;
       }
       return true;
+    } else if (message->GetName() == kV8RunTestMsg) {
+      // Run the test asynchronously.
+      CefPostTask(TID_RENDERER,
+                  NewCefRunnableMethod(this, &V8RendererTest::RunTest));
+      return true;
     }
     return false;
   }
@@ -2086,7 +2086,7 @@ class V8RendererTest : public ClientApp::RenderDelegate {
 
   void DevToolsClosed() {
     browser_->GetMainFrame()->ExecuteJavaScript(
-      "window.setTimeout(test, 0);", "about:blank", 0);
+      "window.setTimeout(test, 0);", browser_->GetMainFrame()->GetURL(), 0);
   }
 
  protected:
@@ -2221,6 +2221,15 @@ class V8TestHandler : public TestHandler {
             browser->GetHost()->GetDevToolsURL(true)));
         EXPECT_TRUE(browser->SendProcessMessage(PID_RENDERER, return_msg));
       }
+    } else {
+      const std::string& url = frame->GetURL();
+      if (url != kV8NavTestUrl &&
+          url.find("http://tests/") != std::string::npos) {
+        // Run the test.
+        CefRefPtr<CefProcessMessage> return_msg =
+              CefProcessMessage::Create(kV8RunTestMsg);
+        EXPECT_TRUE(browser->SendProcessMessage(PID_RENDERER, return_msg));
+      }
     }
   }