diff --git a/patch/patch.cfg b/patch/patch.cfg
index 1d31f6404..e85f8bbe2 100644
--- a/patch/patch.cfg
+++ b/patch/patch.cfg
@@ -155,4 +155,11 @@ patches = [
     'name': 'ime_1610',
     'path': '../ui/base/ime/',
   },
+  {
+    # Fix ScriptForbiddenScope assertion.
+    # https://bitbucket.org/chromiumembedded/cef/issue/1643
+    # https://codereview.chromium.org/1096553003
+    'name': 'webkit_parser_scriptforbidden_1643',
+    'path': '../third_party/WebKit/Source/',
+  },
 ]
diff --git a/patch/patches/webkit_parser_scriptforbidden_1643.patch b/patch/patches/webkit_parser_scriptforbidden_1643.patch
new file mode 100644
index 000000000..5268522c4
--- /dev/null
+++ b/patch/patches/webkit_parser_scriptforbidden_1643.patch
@@ -0,0 +1,36 @@
+diff --git core/html/parser/HTMLConstructionSite.cpp core/html/parser/HTMLConstructionSite.cpp
+index 679749a..487323d 100644
+--- core/html/parser/HTMLConstructionSite.cpp
++++ core/html/parser/HTMLConstructionSite.cpp
+@@ -50,7 +50,6 @@
+ #include "core/loader/FrameLoaderClient.h"
+ #include "core/svg/SVGScriptElement.h"
+ #include "platform/NotImplemented.h"
+-#include "platform/ScriptForbiddenScope.h"
+ #include "platform/text/TextBreakIterator.h"
+ #include <limits>
+ 
+@@ -103,10 +102,8 @@ static inline void insert(HTMLConstructionSiteTask& task)
+     if (isHTMLTemplateElement(*task.parent))
+         task.parent = toHTMLTemplateElement(task.parent.get())->content();
+ 
+-    if (ContainerNode* parent = task.child->parentNode()) {
+-        ScriptForbiddenScope forbidScript;
++    if (ContainerNode* parent = task.child->parentNode())
+         parent->parserRemoveChild(*task.child);
+-    }
+ 
+     if (task.nextChild)
+         task.parent->parserInsertBefore(task.child.get(), *task.nextChild);
+@@ -153,10 +150,8 @@ static inline void executeReparentTask(HTMLConstructionSiteTask& task)
+ {
+     ASSERT(task.operation == HTMLConstructionSiteTask::Reparent);
+ 
+-    if (ContainerNode* parent = task.child->parentNode()) {
+-        ScriptForbiddenScope forbidScript;
++    if (ContainerNode* parent = task.child->parentNode())
+         parent->parserRemoveChild(*task.child);
+-    }
+ 
+     task.parent->parserAppendChild(task.child);
+ }