Quoting Matthew Muller:

I can also confirm that every command works up until Page.navigate. Actually you can reproduce this with just:

{"id":1298498081,"method":"Target.createBrowserContext"}
{"id":1427131847,"method":"Target.createTarget","params":{"browserContextId":"6d6fbee5-024f-4512-bac1-ef3000d6a03a","height":500,"url":"about:blank","width":940}}
{"id":911902081,"method":"Target.attachToTarget","params":{"targetId":"b5e8db2f-2a90-46dd-ad9b-284466a0ba38"}}
{"id":637979947,"method":"Target.sendMessageToTarget","params":{"targetId":"b5e8db2f-2a90-46dd-ad9b-284466a0ba38","message":"{\"id\":629458047,\"method\":\"Page.navigate\",\"params\":{\"url\":\"https://google.com\"}}"}}


Results in

[0703/033315.949451:ERROR:bad_message.cc(23)] Terminating renderer for bad IPC message, reason 138
[0703/033315.949509:FATAL:browser_message_filter.cc(165)] Check failed: false.
#0 0x00000140d027 base::debug::StackTrace::StackTrace()
#1 0x00000141de0d logging::LogMessage::~LogMessage()
#2 0x000000462130 content::BrowserMessageFilter::ShutdownForBadMessage()
#3 0x000000809ad4 content::DOMStorageMessageFilter::OnOpenStorageArea()
#4 0x00000080998f _ZN3IPC8MessageTI38DOMStorageHostMsg_OpenStorageArea_MetaSt5tupleIJil4GURLEEvE8DispatchIN7content23DOMStorageMessageFilterES8_vMS8_FvilRKS3_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#5 0x000000809501 content::DOMStorageMessageFilter::OnMessageReceived()
#6 0x000001456483 base::SequencedWorkerPool::Inner::ThreadLoop()
#7 0x000001455ce1 base::SequencedWorkerPool::Worker::Run()
#8 0x000001458ec5 base::SimpleThread::ThreadMain()
#9 0x0000014552d3 base::(anonymous namespace)::ThreadFunc()
#10 0x7f5a85539dc5 start_thread
#11 0x7f5a835916ed __clone


Received signal 6
#0 0x00000140d027 base::debug::StackTrace::StackTrace()
#1 0x00000140cb9f base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7f5a85541370 <unknown>
#3 0x7f5a834cf1d7 __GI_raise
#4 0x7f5a834d08c8 __GI_abort
#5 0x00000140bce2 base::debug::BreakDebugger()
#6 0x00000141e160 logging::LogMessage::~LogMessage()
#7 0x000000462130 content::BrowserMessageFilter::ShutdownForBadMessage()
#8 0x000000809ad4 content::DOMStorageMessageFilter::OnOpenStorageArea()
#9 0x00000080998f _ZN3IPC8MessageTI38DOMStorageHostMsg_OpenStorageArea_MetaSt5tupleIJil4GURLEEvE8DispatchIN7content23DOMStorageMessageFilterES8_vMS8_FvilRKS3_EEEbPKNS_7MessageEPT_PT0_PT1_T2_
#10 0x000000809501 content::DOMStorageMessageFilter::OnMessageReceived()
#11 0x000001456483 base::SequencedWorkerPool::Inner::ThreadLoop()
#12 0x000001455ce1 base::SequencedWorkerPool::Worker::Run()
#13 0x000001458ec5 base::SimpleThread::ThreadMain()
#14 0x0000014552d3 base::(anonymous namespace)::ThreadFunc()
#15 0x7f5a85539dc5 start_thread

Reason 138 Seems to be DSH_WRONG_STORAGE_PARTITION.