From glancing at

PepperNetworkProxyHost::TryToSendUnsentRequests() [1]
and
PepperNetworkProxyHost::OnResolveProxyCompleted() [2]

It seems to be assuming that ProxyResolutionService::ResolveProxy() requests complete in FIFO order.

That is incorrect, as neither the API for ResolveProxy(), nor its implementation, guarantee FIFO completion of requests.

If the requests complete in a non-FIFO order this could result in a use-after-free from PepperNetworkProxyHost::~PepperNetworkProxyHost as it tries to cancel an already deleted request.

[1] https://cs.chromium.org/chromium/src/content/browser/renderer_host/pepper/pepper_network_proxy_host.cc?sq=package:chromium&dr=CSs&l=151

[2] https://cs.chromium.org/chromium/src/content/browser/renderer_host/pepper/pepper_network_proxy_host.cc?sq=package:chromium&dr=CSs&l=165