diff --git a/libcef/browser/net/chrome_scheme_handler.cc b/libcef/browser/net/chrome_scheme_handler.cc
index 90eaff531..533483340 100644
--- a/libcef/browser/net/chrome_scheme_handler.cc
+++ b/libcef/browser/net/chrome_scheme_handler.cc
@@ -695,6 +695,9 @@ CefWebUIControllerFactory* CefWebUIControllerFactory::GetInstance() {
 
 void RegisterWebUIControllerFactory() {
   // Channel all WebUI handling through CefWebUIControllerFactory.
+  content::WebUIControllerFactory::UnregisterFactoryForTesting(
+      content::ContentWebUIControllerFactory::GetInstance());
+
   content::WebUIControllerFactory::RegisterFactory(
       CefWebUIControllerFactory::GetInstance());
 }
diff --git a/patch/patch.cfg b/patch/patch.cfg
index beb89b91a..c258c3087 100644
--- a/patch/patch.cfg
+++ b/patch/patch.cfg
@@ -436,6 +436,13 @@ patches = [
     # This crash was introduced by https://crrev.com/5f6212babf.
     'name': 'browser_scheduler',
   },
+  {
+    # Restore access to WebUIControllerFactory::UnregisterFactoryForTesting
+    # which was removed in https://crrev.com/5f183d6636. We can't use
+    # ScopedWebUIControllerFactoryRegistration because it pulls in GTest
+    # dependencies.
+    'name': 'browser_web_ui_controller_factory',
+  },
   {
     # Avoid a shutdown crash caused by PrefWatcher holding a reference to
     # |g_browser_process->local_state()|, and the local_state being deleted
diff --git a/patch/patches/browser_web_ui_controller_factory.patch b/patch/patches/browser_web_ui_controller_factory.patch
new file mode 100644
index 000000000..be22e0e1d
--- /dev/null
+++ b/patch/patches/browser_web_ui_controller_factory.patch
@@ -0,0 +1,14 @@
+diff --git content/public/browser/web_ui_controller_factory.h content/public/browser/web_ui_controller_factory.h
+index eb068fb9bb42c..4e8e6a1a7abf4 100644
+--- content/public/browser/web_ui_controller_factory.h
++++ content/public/browser/web_ui_controller_factory.h
+@@ -47,9 +47,6 @@ class CONTENT_EXPORT WebUIControllerFactory {
+   virtual bool UseWebUIForURL(BrowserContext* browser_context,
+                               const GURL& url) = 0;
+ 
+- private:
+-  friend class ScopedWebUIControllerFactoryRegistration;
+-
+   static void UnregisterFactoryForTesting(WebUIControllerFactory* factory);
+ };
+ 
diff --git a/patch/patches/chrome_runtime.patch b/patch/patches/chrome_runtime.patch
index 554356b83..8d7e05870 100644
--- a/patch/patches/chrome_runtime.patch
+++ b/patch/patches/chrome_runtime.patch
@@ -78,7 +78,7 @@ index 132735e3a1200..0d392976799a4 100644
  
  #endif  // BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
 diff --git chrome/browser/chrome_browser_main.cc chrome/browser/chrome_browser_main.cc
-index 4e9969d9c5b0b..e599b114f021d 100644
+index 4e9969d9c5b0b..0e734d8661db0 100644
 --- chrome/browser/chrome_browser_main.cc
 +++ chrome/browser/chrome_browser_main.cc
 @@ -52,6 +52,7 @@
@@ -89,21 +89,7 @@ index 4e9969d9c5b0b..e599b114f021d 100644
  #include "chrome/browser/about_flags.h"
  #include "chrome/browser/active_use_util.h"
  #include "chrome/browser/after_startup_task_utils.h"
-@@ -1530,11 +1531,13 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
-         browser_process_->local_state());
-   }
- 
-+#if !BUILDFLAG(ENABLE_CEF)
-   // Needs to be done before PostProfileInit, since login manager on CrOS is
-   // called inside PostProfileInit.
-   content::WebUIControllerFactory::RegisterFactory(
-       ChromeWebUIControllerFactory::GetInstance());
-   ChromeUntrustedWebUIControllerFactory::RegisterInstance();
-+#endif
- 
- #if BUILDFLAG(IS_ANDROID)
-   page_info::SetPageInfoClient(new ChromePageInfoClient());
-@@ -1757,11 +1760,14 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
+@@ -1757,11 +1758,14 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
    // This step is costly and is already measured in
    // Startup.StartupBrowserCreator_Start.
    // See the comment above for an explanation of |process_command_line|.
@@ -119,7 +105,7 @@ index 4e9969d9c5b0b..e599b114f021d 100644
  // TODO(crbug.com/1052397): Revisit the macro expression once build flag switch
  // of lacros-chrome is complete.
  #if BUILDFLAG(IS_WIN) || (BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS_LACROS))
-@@ -1789,8 +1795,10 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
+@@ -1789,8 +1793,10 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
  
      // Create the RunLoop for MainMessageLoopRun() to use and transfer
      // ownership of the browser's lifetime to the BrowserProcess.