diff --git a/src/Playwright.Tests/BrowserContextBasicTests.cs b/src/Playwright.Tests/BrowserContextBasicTests.cs
index c0f352b7e..7df78b389 100644
--- a/src/Playwright.Tests/BrowserContextBasicTests.cs
+++ b/src/Playwright.Tests/BrowserContextBasicTests.cs
@@ -312,4 +312,18 @@ public async Task ShouldEmulateNavigatorOnLine()
         await context.SetOfflineAsync(false);
         Assert.True(await page.EvaluateAsync<bool>("() => window.navigator.onLine"));
     }
+
+    [PlaywrightTest]
+    public async Task ShouldAllowOpeningPagesWhileEnumeratingPages()
+    {
+        // Pages used to hand out the live list, so a page opened from inside the loop made the
+        // next MoveNext throw "Collection was modified".
+        await using var context = await Browser.NewContextAsync();
+        await context.NewPageAsync();
+        foreach (var page in context.Pages)
+        {
+            await context.NewPageAsync();
+        }
+        Assert.AreEqual(2, context.Pages.Count);
+    }
 }
diff --git a/src/Playwright.Tests/FrameHierarchyTests.cs b/src/Playwright.Tests/FrameHierarchyTests.cs
index eeb6e8dcb..8b4f0b365 100644
--- a/src/Playwright.Tests/FrameHierarchyTests.cs
+++ b/src/Playwright.Tests/FrameHierarchyTests.cs
@@ -209,4 +209,18 @@ await Page.EvaluateAsync(@"() => {
         Assert.False(frame2.IsDetached);
         Assert.That(frame1, Is.Not.EqualTo(frame2));
     }
+
+    [PlaywrightTest]
+    public async Task ShouldAllowAttachingFramesWhileEnumeratingChildFrames()
+    {
+        // ChildFrames used to hand out the live list, so a frame attached from inside the loop
+        // made the next MoveNext throw "Collection was modified".
+        await Page.GotoAsync(Server.EmptyPage);
+        await FrameUtils.AttachFrameAsync(Page, "frame1", Server.EmptyPage);
+        foreach (var frame in Page.MainFrame.ChildFrames)
+        {
+            await FrameUtils.AttachFrameAsync(Page, "frame2", Server.EmptyPage);
+        }
+        Assert.AreEqual(2, Page.MainFrame.ChildFrames.Count);
+    }
 }
diff --git a/src/Playwright/Core/Browser.cs b/src/Playwright/Core/Browser.cs
index e5e2b874d..384785c58 100644
--- a/src/Playwright/Core/Browser.cs
+++ b/src/Playwright/Core/Browser.cs
@@ -57,7 +57,7 @@ internal Browser(ChannelOwner parent, string guid, BrowserInitializer initialize
 
     public event EventHandler<IBrowserContext>? Context;
 
-    public IReadOnlyList<IBrowserContext> Contexts => _contexts.ToArray();
+    public IReadOnlyList<IBrowserContext> Contexts => Snapshot(_contexts);
 
     public bool IsConnected { get; private set; }
 
@@ -281,7 +281,7 @@ internal void ConnectToBrowserType(BrowserType browserType, string? tracesDir)
         // This is why browser type is not wired up in the constructor, and instead this separate method is called later on.
         _browserType = browserType;
         _tracesDir = tracesDir;
-        foreach (var context in _contexts)
+        foreach (var context in Snapshot(_contexts))
         {
             context._tracing._tracesDir = this._tracesDir;
             context._request._tracing._tracesDir = this._tracesDir;
@@ -292,7 +292,10 @@ internal void ConnectToBrowserType(BrowserType browserType, string? tracesDir)
     private void DidCreateContext(BrowserContext context)
     {
         context._browser = this;
-        _contexts.Add(context);
+        lock (_connection.DispatchLock)
+        {
+            _contexts.Add(context);
+        }
         // Note: when connecting to a browser, initial contexts arrive before `_browserType` is set,
         // and will be configured later in `ConnectToBrowserType`.
         if (_browserType != null)
diff --git a/src/Playwright/Core/BrowserContext.cs b/src/Playwright/Core/BrowserContext.cs
index 6f41d2d44..a67bbff77 100644
--- a/src/Playwright/Core/BrowserContext.cs
+++ b/src/Playwright/Core/BrowserContext.cs
@@ -159,7 +159,7 @@ public event EventHandler<IRequest> RequestFailed
 
     public IBrowser? Browser => _browser;
 
-    public IReadOnlyList<IPage> Pages => _pages;
+    public IReadOnlyList<IPage> Pages => Snapshot(_pages);
 
     internal Page? OwnerPage { get; set; }
 
@@ -173,7 +173,7 @@ public event EventHandler<IRequest> RequestFailed
 
     public IAPIRequestContext APIRequest => _request;
 
-    public IReadOnlyList<IWorker> ServiceWorkers => _serviceWorkers;
+    public IReadOnlyList<IWorker> ServiceWorkers => Snapshot(_serviceWorkers);
 
     public IReadOnlyList<IPage> BackgroundPages => new List<IPage>();
 
@@ -245,7 +245,10 @@ internal override void OnMessage(string method, JsonElement serverParams)
                 {
                     var serviceWorker = serverParams.GetProperty("worker").ToObject<Worker>(_connection.DefaultJsonSerializerOptions)!;
                     ((Worker)serviceWorker).Context = this;
-                    _serviceWorkers.Add(serviceWorker);
+                    lock (_connection.DispatchLock)
+                    {
+                        _serviceWorkers.Add(serviceWorker);
+                    }
                     ServiceWorker?.Invoke(this, serviceWorker);
                     break;
                 }
@@ -729,7 +732,7 @@ internal async Task OnRouteAsync(Route route)
     {
         route._context = this;
         var page = route._request.SafePage;
-        var routeHandlers = _routes.ToArray();
+        var routeHandlers = Snapshot(_routes);
         foreach (var routeHandler in routeHandlers)
         {
             // If the page or the context was closed we stall all requests right away.
@@ -741,16 +744,24 @@ internal async Task OnRouteAsync(Route route)
             {
                 continue;
             }
-            if (!_routes.Contains(routeHandler))
-            {
-                continue;
-            }
-            if (routeHandler.WillExpire())
+            bool noRoutesLeft;
+            lock (_connection.DispatchLock)
             {
-                _routes.Remove(routeHandler);
+                if (!_routes.Contains(routeHandler))
+                {
+                    continue;
+                }
+                if (routeHandler.WillExpire())
+                {
+                    _routes.Remove(routeHandler);
+                }
+                // Counted here, under the lock, rather than in HandleAsync: two matching requests
+                // handled concurrently must not both see the count before the other's increment.
+                routeHandler.HandledCount++;
+                noRoutesLeft = _routes.Count == 0;
             }
             var handled = await routeHandler.HandleAsync(route).ConfigureAwait(false);
-            if (_routes.Count == 0)
+            if (noRoutesLeft)
             {
                 UpdateInterceptionAsync().IgnoreException();
             }
@@ -773,7 +784,7 @@ internal async Task OnRouteAsync(Route route)
 
     internal async Task OnWebSocketRouteAsync(WebSocketRoute webSocketRoute)
     {
-        var routeHandler = _webSocketRoutes.Find(route => route.Matches(webSocketRoute.Url));
+        var routeHandler = Array.Find(Snapshot(_webSocketRoutes), route => route.Matches(webSocketRoute.Url));
         if (routeHandler != null)
         {
             await routeHandler.HandleAsync(webSocketRoute).ConfigureAwait(false);
@@ -805,7 +816,10 @@ private async Task<IAsyncDisposable> RouteAsync(string? globMatch, Regex? reMatc
             Handler = handler,
             Times = options?.Times,
         };
-        _routes.Insert(0, setting);
+        lock (_connection.DispatchLock)
+        {
+            _routes.Insert(0, setting);
+        }
         await UpdateInterceptionAsync().ConfigureAwait(false);
         return new DisposableStub(async () =>
         {
@@ -817,15 +831,18 @@ private async Task UnrouteAsync(string? globMatch, Regex? reMatch, Func<string,
     {
         var removed = new List<RouteHandler>();
         var remaining = new List<RouteHandler>();
-        foreach (var routeHandler in _routes)
+        lock (_connection.DispatchLock)
         {
-            if (routeHandler.urlMatcher.Equals(globMatch, reMatch, funcMatch, BaseURL, false) && (handler == null || routeHandler.Handler == handler))
+            foreach (var routeHandler in _routes)
             {
-                removed.Add(routeHandler);
-            }
-            else
-            {
-                remaining.Add(routeHandler);
+                if (routeHandler.urlMatcher.Equals(globMatch, reMatch, funcMatch, BaseURL, false) && (handler == null || routeHandler.Handler == handler))
+                {
+                    removed.Add(routeHandler);
+                }
+                else
+                {
+                    remaining.Add(routeHandler);
+                }
             }
         }
         await UnrouteInternalAsync(removed, remaining, UnrouteBehavior.Default).ConfigureAwait(false);
@@ -833,7 +850,10 @@ private async Task UnrouteAsync(string? globMatch, Regex? reMatch, Func<string,
 
     private async Task UnrouteInternalAsync(List<RouteHandler> removed, List<RouteHandler> remaining, UnrouteBehavior? behavior)
     {
-        _routes = remaining;
+        lock (_connection.DispatchLock)
+        {
+            _routes = remaining;
+        }
         if (behavior != null && behavior != UnrouteBehavior.Default)
         {
             var tasks = removed.Select(routeHandler => routeHandler.StopAsync(behavior.Value));
@@ -844,7 +864,11 @@ private async Task UnrouteInternalAsync(List<RouteHandler> removed, List<RouteHa
 
     private async Task UpdateInterceptionAsync()
     {
-        var patterns = RouteHandler.PrepareInterceptionPatterns(_routes);
+        List<Dictionary<string, object>> patterns;
+        lock (_connection.DispatchLock)
+        {
+            patterns = RouteHandler.PrepareInterceptionPatterns(_routes);
+        }
         await SendMessageToServerAsync(
             "setNetworkInterceptionPatterns",
             new Dictionary<string, object?>
@@ -858,7 +882,10 @@ internal void OnClose()
         ClosingOrClosed = true;
         if (Browser != null)
         {
-            ((Browser)Browser)._contexts.Remove(this);
+            lock (_connection.DispatchLock)
+            {
+                ((Browser)Browser)._contexts.Remove(this);
+            }
             ((Browser)Browser)._browserType.Playwright._selectors._contextsForSelectors.Remove(this);
         }
 
@@ -884,7 +911,10 @@ internal void OnClose()
     private void Channel_OnPage(object sender, Page page)
     {
         page.Context = this;
-        _pages.Add(page);
+        lock (_connection.DispatchLock)
+        {
+            _pages.Add(page);
+        }
         Page?.Invoke(this, page);
 
         if (page.Opener?.IsClosed == false)
@@ -895,7 +925,12 @@ private void Channel_OnPage(object sender, Page page)
 
     private void Channel_BindingCall(BindingCall bindingCall)
     {
-        if (_bindings.TryGetValue(bindingCall.Name, out var binding))
+        Delegate? binding;
+        lock (_connection.DispatchLock)
+        {
+            _bindings.TryGetValue(bindingCall.Name, out binding);
+        }
+        if (binding != null)
         {
             _ = bindingCall.CallAsync(binding);
         }
@@ -905,20 +940,23 @@ private void Channel_BindingCall(BindingCall bindingCall)
 
     private async Task<IAsyncDisposable> ExposeBindingAsync(string name, Delegate callback)
     {
-        foreach (var page in _pages)
+        lock (_connection.DispatchLock)
         {
-            if (page.Bindings.ContainsKey(name))
+            foreach (var page in _pages)
             {
-                throw new PlaywrightException($"Function \"{name}\" has been already registered in one of the pages");
+                if (page.Bindings.ContainsKey(name))
+                {
+                    throw new PlaywrightException($"Function \"{name}\" has been already registered in one of the pages");
+                }
             }
-        }
 
-        if (_bindings.ContainsKey(name))
-        {
-            throw new PlaywrightException($"Function \"{name}\" has been already registered");
-        }
+            if (_bindings.ContainsKey(name))
+            {
+                throw new PlaywrightException($"Function \"{name}\" has been already registered");
+            }
 
-        _bindings.Add(name, callback);
+            _bindings.Add(name, callback);
+        }
 
         var result = await SendMessageToServerAsync(
             "exposeBinding",
@@ -959,17 +997,25 @@ public async Task RouteFromHARAsync(string har, BrowserContextRouteFromHAROption
             UrlRegex = options?.UrlRegex,
             UrlString = options?.UrlString,
         }).ConfigureAwait(false);
-        _harRouters.Add(harRouter);
+        lock (_connection.DispatchLock)
+        {
+            _harRouters.Add(harRouter);
+        }
         await harRouter.AddContextRouteAsync(this).ConfigureAwait(false);
     }
 
     private void DisposeHarRouters()
     {
-        foreach (var router in _harRouters)
+        HarRouter[] routers;
+        lock (_connection.DispatchLock)
+        {
+            routers = _harRouters.ToArray();
+            _harRouters.Clear();
+        }
+        foreach (var router in routers)
         {
             router.Dispose();
         }
-        _harRouters.Clear();
     }
 
     [MethodImpl(MethodImplOptions.NoInlining)]
@@ -986,7 +1032,7 @@ public Task RouteWebSocketAsync(Func<string, bool> url, Action<IWebSocketRoute>
 
     private Task RouteWebSocketAsync(string? globMatch, Regex? reMatch, Func<string, bool>? funcMatch, Delegate handler)
     {
-        _webSocketRoutes.Insert(0, new WebSocketRouteHandler()
+        var routeHandler = new WebSocketRouteHandler()
         {
             urlMatcher = new URLMatch()
             {
@@ -997,13 +1043,21 @@ private Task RouteWebSocketAsync(string? globMatch, Regex? reMatch, Func<string,
                 isWebSocketUrl = true,
             },
             Handler = handler,
-        });
+        };
+        lock (_connection.DispatchLock)
+        {
+            _webSocketRoutes.Insert(0, routeHandler);
+        }
         return UpdateWebSocketInterceptionAsync();
     }
 
     private async Task UpdateWebSocketInterceptionAsync()
     {
-        var patterns = WebSocketRouteHandler.PrepareInterceptionPatterns(_webSocketRoutes);
+        List<Dictionary<string, object>> patterns;
+        lock (_connection.DispatchLock)
+        {
+            patterns = WebSocketRouteHandler.PrepareInterceptionPatterns(_webSocketRoutes);
+        }
         await SendMessageToServerAsync("setWebSocketInterceptionPatterns", new Dictionary<string, object?>
         {
             ["patterns"] = patterns,
diff --git a/src/Playwright/Core/BrowserType.cs b/src/Playwright/Core/BrowserType.cs
index 18a81c90e..cdb4d6011 100644
--- a/src/Playwright/Core/BrowserType.cs
+++ b/src/Playwright/Core/BrowserType.cs
@@ -187,9 +187,9 @@ void ClosePipe()
         void OnPipeClosed(string? reason = null)
         {
             // Emulate all pages, contexts and the browser closing upon disconnect.
-            foreach (BrowserContext context in browser?._contexts.ToArray() ?? Array.Empty<BrowserContext>())
+            foreach (BrowserContext context in browser?.Snapshot(browser._contexts) ?? Array.Empty<BrowserContext>())
             {
-                foreach (Page page in context._pages.ToArray())
+                foreach (Page page in context.Snapshot(context._pages))
                 {
                     page.OnClose();
                 }
diff --git a/src/Playwright/Core/CDPSession.cs b/src/Playwright/Core/CDPSession.cs
index 9f508fb5e..82f0dd64d 100644
--- a/src/Playwright/Core/CDPSession.cs
+++ b/src/Playwright/Core/CDPSession.cs
@@ -73,23 +73,24 @@ internal override void OnMessage(string method, JsonElement serverParams)
 
     private void OnCDPEvent(string name, JsonElement? @params)
     {
-        if (_cdpSessionEvents.TryGetValue(name, out var cdpNamedEvent))
+        CDPSessionEvent? cdpNamedEvent;
+        lock (_connection.DispatchLock)
         {
-            cdpNamedEvent.RaiseEvent(@params);
+            _cdpSessionEvents.TryGetValue(name, out cdpNamedEvent);
         }
+        cdpNamedEvent?.RaiseEvent(@params);
     }
 
     [MethodImpl(MethodImplOptions.NoInlining)]
     public ICDPSessionEvent Event(string eventName)
     {
-        if (_cdpSessionEvents.TryGetValue(eventName, out var cdpNamedEvent))
+        lock (_connection.DispatchLock)
         {
-            return cdpNamedEvent;
-        }
-        else
-        {
-            cdpNamedEvent = new(eventName);
-            _cdpSessionEvents.Add(eventName, cdpNamedEvent);
+            if (!_cdpSessionEvents.TryGetValue(eventName, out var cdpNamedEvent))
+            {
+                cdpNamedEvent = new(eventName);
+                _cdpSessionEvents.Add(eventName, cdpNamedEvent);
+            }
             return cdpNamedEvent;
         }
     }
diff --git a/src/Playwright/Core/Frame.cs b/src/Playwright/Core/Frame.cs
index ee9551cf4..bdfbc3f60 100644
--- a/src/Playwright/Core/Frame.cs
+++ b/src/Playwright/Core/Frame.cs
@@ -64,7 +64,7 @@ internal Frame(ChannelOwner parent, string guid, FrameInitializer initializer) :
     /// </summary>
     public event EventHandler<WaitUntilState>? LoadState;
 
-    public IReadOnlyList<IFrame> ChildFrames => _childFrames;
+    public IReadOnlyList<IFrame> ChildFrames => Snapshot(_childFrames);
 
     public string Name { get; internal set; }
 
diff --git a/src/Playwright/Core/Page.cs b/src/Playwright/Core/Page.cs
index d15d98121..b89ef71f0 100644
--- a/src/Playwright/Core/Page.cs
+++ b/src/Playwright/Core/Page.cs
@@ -195,7 +195,7 @@ public IMouse Mouse
 
     public string Url => MainFrame.Url;
 
-    public IReadOnlyList<IFrame> Frames => _frames.ToList().AsReadOnly();
+    public IReadOnlyList<IFrame> Frames => Snapshot(_frames);
 
     public IKeyboard Keyboard { get; }
 
@@ -207,7 +207,7 @@ public IMouse Mouse
 
     public IWebStorage SessionStorage { get; }
 
-    public IReadOnlyList<IWorker> Workers => _workers;
+    public IReadOnlyList<IWorker> Workers => Snapshot(_workers);
 
     public IVideo? Video
     {
@@ -287,7 +287,10 @@ internal override void OnMessage(string method, JsonElement serverParams)
                 break;
             case "worker":
                 var worker = serverParams.GetProperty("worker").ToObject<Worker>(_connection.DefaultJsonSerializerOptions);
-                _workers.Add(worker);
+                lock (_connection.DispatchLock)
+                {
+                    _workers.Add(worker);
+                }
                 worker.Page = this;
                 Worker?.Invoke(this, worker);
                 break;
@@ -1288,7 +1291,10 @@ private async Task<IAsyncDisposable> RouteAsync(string? globMatch, Regex? reMatc
             Handler = handler,
             Times = options?.Times,
         };
-        _routes.Insert(0, setting);
+        lock (_connection.DispatchLock)
+        {
+            _routes.Insert(0, setting);
+        }
         await UpdateInterceptionAsync().ConfigureAwait(false);
         return new DisposableStub(async () =>
         {
@@ -1300,15 +1306,18 @@ private async Task UnrouteAsync(string? globMatch, Regex? reMatch, Func<string,
     {
         var removed = new List<RouteHandler>();
         var remaining = new List<RouteHandler>();
-        foreach (var routeHandler in _routes)
+        lock (_connection.DispatchLock)
         {
-            if (routeHandler.urlMatcher.Equals(globMatch, reMatch, funcMatch, Context.BaseURL, false) && (handler == null || routeHandler.Handler == handler))
-            {
-                removed.Add(routeHandler);
-            }
-            else
+            foreach (var routeHandler in _routes)
             {
-                remaining.Add(routeHandler);
+                if (routeHandler.urlMatcher.Equals(globMatch, reMatch, funcMatch, Context.BaseURL, false) && (handler == null || routeHandler.Handler == handler))
+                {
+                    removed.Add(routeHandler);
+                }
+                else
+                {
+                    remaining.Add(routeHandler);
+                }
             }
         }
         await UnrouteInternalAsync(removed, remaining, UnrouteBehavior.Default).ConfigureAwait(false);
@@ -1316,7 +1325,10 @@ private async Task UnrouteAsync(string? globMatch, Regex? reMatch, Func<string,
 
     private async Task UnrouteInternalAsync(List<RouteHandler> removed, List<RouteHandler> remaining, UnrouteBehavior? behavior)
     {
-        _routes = remaining;
+        lock (_connection.DispatchLock)
+        {
+            _routes = remaining;
+        }
         if (behavior != null && behavior != UnrouteBehavior.Default)
         {
             var tasks = removed.Select(routeHandler => routeHandler.StopAsync(behavior.Value));
@@ -1328,7 +1340,11 @@ private async Task UnrouteInternalAsync(List<RouteHandler> removed, List<RouteHa
 
     private async Task UpdateInterceptionAsync()
     {
-        var patterns = RouteHandler.PrepareInterceptionPatterns(_routes);
+        List<Dictionary<string, object>> patterns;
+        lock (_connection.DispatchLock)
+        {
+            patterns = RouteHandler.PrepareInterceptionPatterns(_routes);
+        }
         await SendMessageToServerAsync("setNetworkInterceptionPatterns", new Dictionary<string, object?>
         {
             ["patterns"] = patterns,
@@ -1338,7 +1354,10 @@ private async Task UpdateInterceptionAsync()
     internal void OnClose()
     {
         IsClosed = true;
-        Context._pages.Remove(this);
+        lock (_connection.DispatchLock)
+        {
+            Context._pages.Remove(this);
+        }
         DisposeHarRouters();
         Close?.Invoke(this, this);
         Context?.FirePageClose(this);
@@ -1351,7 +1370,12 @@ private void Channel_Crashed()
 
     private void Channel_BindingCall(object sender, BindingCall bindingCall)
     {
-        if (Bindings.TryGetValue(bindingCall.Name, out var binding))
+        Delegate? binding;
+        lock (_connection.DispatchLock)
+        {
+            Bindings.TryGetValue(bindingCall.Name, out binding);
+        }
+        if (binding != null)
         {
             _ = bindingCall.CallAsync(binding);
         }
@@ -1362,7 +1386,7 @@ private void Channel_BindingCall(object sender, BindingCall bindingCall)
     private async Task OnRouteAsync(Route route)
     {
         route._context = Context;
-        foreach (var routeHandler in _routes.ToArray())
+        foreach (var routeHandler in Snapshot(_routes))
         {
             // If the page was closed we stall all requests right away.
             if (CloseWasCalled || Context.ClosingOrClosed)
@@ -1373,16 +1397,24 @@ private async Task OnRouteAsync(Route route)
             {
                 continue;
             }
-            if (!_routes.Contains(routeHandler))
+            bool noRoutesLeft;
+            lock (_connection.DispatchLock)
             {
-                continue;
-            }
-            if (routeHandler.WillExpire())
-            {
-                _routes.Remove(routeHandler);
+                if (!_routes.Contains(routeHandler))
+                {
+                    continue;
+                }
+                if (routeHandler.WillExpire())
+                {
+                    _routes.Remove(routeHandler);
+                }
+                // Counted here, under the lock, rather than in HandleAsync: two matching requests
+                // handled concurrently must not both see the count before the other's increment.
+                routeHandler.HandledCount++;
+                noRoutesLeft = _routes.Count == 0;
             }
             var handled = await routeHandler.HandleAsync(route).ConfigureAwait(false);
-            if (_routes.Count == 0)
+            if (noRoutesLeft)
             {
                 UpdateInterceptionAsync().IgnoreException();
             }
@@ -1397,7 +1429,7 @@ private async Task OnRouteAsync(Route route)
 
     private async Task OnWebSocketRouteAsync(WebSocketRoute webSocketRoute)
     {
-        var routeHandler = _webSocketRoutes.Find(route => route.Matches(webSocketRoute.Url));
+        var routeHandler = Array.Find(Snapshot(_webSocketRoutes), route => route.Matches(webSocketRoute.Url));
         if (routeHandler != null)
         {
             await routeHandler.HandleAsync(webSocketRoute).ConfigureAwait(false);
@@ -1411,9 +1443,12 @@ private async Task OnWebSocketRouteAsync(WebSocketRoute webSocketRoute)
     private void Channel_FrameDetached(object sender, IFrame args)
     {
         var frame = (Frame)args;
-        _frames.Remove(frame);
-        frame.IsDetached = true;
-        frame.ParentFrame?._childFrames?.Remove(frame);
+        lock (_connection.DispatchLock)
+        {
+            _frames.Remove(frame);
+            frame.IsDetached = true;
+            frame.ParentFrame?._childFrames?.Remove(frame);
+        }
         FrameDetached?.Invoke(this, args);
         Context?.FireFrameDetached(args);
     }
@@ -1422,20 +1457,26 @@ private void Channel_FrameAttached(object sender, IFrame args)
     {
         var frame = (Frame)args;
         frame.Page = this;
-        _frames.Add(frame);
-        frame.ParentFrame?._childFrames?.Add(frame);
+        lock (_connection.DispatchLock)
+        {
+            _frames.Add(frame);
+            frame.ParentFrame?._childFrames?.Add(frame);
+        }
         FrameAttached?.Invoke(this, args);
         Context?.FireFrameAttached(args);
     }
 
     private async Task<IAsyncDisposable> InnerExposeBindingAsync(string name, Delegate callback)
     {
-        if (Bindings.ContainsKey(name))
+        lock (_connection.DispatchLock)
         {
-            throw new PlaywrightException($"Function \"{name}\" has been already registered");
-        }
+            if (Bindings.ContainsKey(name))
+            {
+                throw new PlaywrightException($"Function \"{name}\" has been already registered");
+            }
 
-        Bindings.Add(name, callback);
+            Bindings.Add(name, callback);
+        }
 
         var result = await SendMessageToServerAsync(
             "exposeBinding",
@@ -1488,17 +1529,25 @@ await Context.RecordIntoHarAsync(
             Url = options?.Url,
             UrlString = options?.UrlString,
         }).ConfigureAwait(false);
-        _harRouters.Add(harRouter);
+        lock (_connection.DispatchLock)
+        {
+            _harRouters.Add(harRouter);
+        }
         await harRouter.AddPageRouteAsync(this).ConfigureAwait(false);
     }
 
     private void DisposeHarRouters()
     {
-        foreach (var router in _harRouters)
+        HarRouter[] routers;
+        lock (_connection.DispatchLock)
+        {
+            routers = _harRouters.ToArray();
+            _harRouters.Clear();
+        }
+        foreach (var router in routers)
         {
             router.Dispose();
         }
-        _harRouters.Clear();
     }
 
     [MethodImpl(MethodImplOptions.NoInlining)]
@@ -1637,7 +1686,10 @@ private async Task AddLocatorHandlerImplAsync(ILocator locator, object handler,
             ["noWaitAfter"] = options?.NoWaitAfter,
         }).ConfigureAwait(false);
 
-        _locatorHandlers.Add(response!.Value.GetProperty("uid").GetInt32(), new LocatorHandler((Locator)locator, handler, options?.Times));
+        lock (_connection.DispatchLock)
+        {
+            _locatorHandlers.Add(response!.Value.GetProperty("uid").GetInt32(), new LocatorHandler((Locator)locator, handler, options?.Times));
+        }
     }
 
     private async Task Channel_LocatorHandlerTriggeredAsync(int uid)
@@ -1645,24 +1697,33 @@ private async Task Channel_LocatorHandlerTriggeredAsync(int uid)
         var remove = false;
         try
         {
-            if (_locatorHandlers.TryGetValue(uid, out var handler))
+            LocatorHandler? handler;
+            var shouldHandle = false;
+            lock (_connection.DispatchLock)
             {
-                if (handler.Times != 0)
+                if (_locatorHandlers.TryGetValue(uid, out handler) && handler.Times != 0)
                 {
                     if (handler.Times != null)
                     {
                         handler.Times--;
                     }
-                    await handler.HandleAsync().ConfigureAwait(false);
+                    shouldHandle = true;
                 }
-                remove = handler.Times == 0;
             }
+            if (shouldHandle)
+            {
+                await handler!.HandleAsync().ConfigureAwait(false);
+            }
+            remove = handler?.Times == 0;
         }
         finally
         {
             if (remove)
             {
-                _locatorHandlers.Remove(uid);
+                lock (_connection.DispatchLock)
+                {
+                    _locatorHandlers.Remove(uid);
+                }
             }
             SendMessageToServerAsync("resolveLocatorHandlerNoReply", new Dictionary<string, object?>
             {
@@ -1674,12 +1735,20 @@ private async Task Channel_LocatorHandlerTriggeredAsync(int uid)
 
     public async Task RemoveLocatorHandlerAsync(ILocator locator)
     {
-        foreach (KeyValuePair<int, LocatorHandler> entry in _locatorHandlers)
+        KeyValuePair<int, LocatorHandler>[] entries;
+        lock (_connection.DispatchLock)
+        {
+            entries = _locatorHandlers.ToArray();
+        }
+        foreach (var entry in entries)
         {
             var (uid, data) = (entry.Key, entry.Value);
             if (data.Locator.EqualLocator((Locator)locator))
             {
-                _locatorHandlers.Remove(uid);
+                lock (_connection.DispatchLock)
+                {
+                    _locatorHandlers.Remove(uid);
+                }
                 try
                 {
                     await SendMessageToServerAsync("unregisterLocatorHandler", new Dictionary<string, object?>
@@ -1709,7 +1778,7 @@ public Task RouteWebSocketAsync(Func<string, bool> url, Action<IWebSocketRoute>
 
     private Task RouteWebSocketAsync(string? globMatch, Regex? urlRegex, Func<string, bool>? urlFunc, Delegate handler)
     {
-        _webSocketRoutes.Insert(0, new WebSocketRouteHandler()
+        var routeHandler = new WebSocketRouteHandler()
         {
             urlMatcher = new URLMatch()
             {
@@ -1720,13 +1789,21 @@ private Task RouteWebSocketAsync(string? globMatch, Regex? urlRegex, Func<string
                 isWebSocketUrl = true,
             },
             Handler = handler,
-        });
+        };
+        lock (_connection.DispatchLock)
+        {
+            _webSocketRoutes.Insert(0, routeHandler);
+        }
         return UpdateWebSocketInterceptionAsync();
     }
 
     private async Task UpdateWebSocketInterceptionAsync()
     {
-        var patterns = WebSocketRouteHandler.PrepareInterceptionPatterns(_webSocketRoutes);
+        List<Dictionary<string, object>> patterns;
+        lock (_connection.DispatchLock)
+        {
+            patterns = WebSocketRouteHandler.PrepareInterceptionPatterns(_webSocketRoutes);
+        }
         await SendMessageToServerAsync("setWebSocketInterceptionPatterns", new Dictionary<string, object?>
         {
             ["patterns"] = patterns,
diff --git a/src/Playwright/Core/RouteHandler.cs b/src/Playwright/Core/RouteHandler.cs
index 654068788..70eca0e19 100644
--- a/src/Playwright/Core/RouteHandler.cs
+++ b/src/Playwright/Core/RouteHandler.cs
@@ -42,6 +42,8 @@ internal class RouteHandler
 
     public int? Times { get; internal set; }
 
+    // Incremented by the owning page or context under the dispatch lock, together with the
+    // WillExpire() check, so that matching requests handled concurrently see each other.
     public int HandledCount { get; set; }
 
     public static List<Dictionary<string, object>> PrepareInterceptionPatterns(List<RouteHandler> handlers)
@@ -138,7 +140,6 @@ public async Task StopAsync(UnrouteBehavior behavior)
 
     private async Task<bool> HandleInternalAsync(Route route)
     {
-        ++HandledCount;
         var handledTask = route.StartHandlingAsync();
         var maybeTask = Handler.DynamicInvoke(new object[] { route });
         if (maybeTask is Task task)
diff --git a/src/Playwright/Core/Worker.cs b/src/Playwright/Core/Worker.cs
index ecf98b656..fdb906c05 100644
--- a/src/Playwright/Core/Worker.cs
+++ b/src/Playwright/Core/Worker.cs
@@ -75,14 +75,10 @@ internal override void OnMessage(string method, JsonElement serverParams)
 
     internal void OnClose()
     {
-        if (Page != null)
+        lock (_connection.DispatchLock)
         {
-            Page._workers.Remove(this);
-        }
-
-        if (Context != null)
-        {
-            Context._serviceWorkers.Remove(this);
+            Page?._workers.Remove(this);
+            Context?._serviceWorkers.Remove(this);
         }
 
         Close?.Invoke(this, this);
diff --git a/src/Playwright/Transport/ChannelOwner.cs b/src/Playwright/Transport/ChannelOwner.cs
index b815b2d8b..8cfb3a58c 100644
--- a/src/Playwright/Transport/ChannelOwner.cs
+++ b/src/Playwright/Transport/ChannelOwner.cs
@@ -64,6 +64,16 @@ internal virtual void OnMessage(string method, JsonElement serverParams)
     {
     }
 
+    // Copies a list that the message pump mutates under the dispatch lock. Getters return the
+    // copy, and code that iterates outside the lock iterates the copy.
+    internal T[] Snapshot<T>(List<T> list)
+    {
+        lock (_connection.DispatchLock)
+        {
+            return list.ToArray();
+        }
+    }
+
     internal void Adopt(ChannelOwner child)
     {
         child.Parent!.Objects.TryRemove(child.Guid, out _);
diff --git a/src/Playwright/Transport/Connection.cs b/src/Playwright/Transport/Connection.cs
index ba8ab3745..709502102 100644
--- a/src/Playwright/Transport/Connection.cs
+++ b/src/Playwright/Transport/Connection.cs
@@ -52,6 +52,13 @@ internal class Connection : IDisposable
     private readonly Root _rootObject;
     private readonly TaskQueue _queue = new();
     private readonly string _callIdPrefix = CreateCallIdPrefix();
+
+    // Taken by the message pump around every write to client-side state that user code reads
+    // (the lists of pages, frames, workers and contexts; the route, binding and handler
+    // registries) and by every reader of that state. Critical sections are synchronous and
+    // never run user code, so the lock is never held across an await.
+    internal readonly object DispatchLock = new();
+
     private int _tracingCount;
     private int _lastId;
     private Exception? _closedError;
@@ -118,11 +125,11 @@ internal void SetIsTracing(bool isTracing)
     {
         if (isTracing)
         {
-            _tracingCount++;
+            Interlocked.Increment(ref _tracingCount);
         }
         else
         {
-            _tracingCount--;
+            Interlocked.Decrement(ref _tracingCount);
         }
     }
 
@@ -204,7 +211,7 @@ private async Task<T> InnerSendMessageToServerAsync<T>(
             };
         }
 
-        if (_tracingCount > 0 && frames.Count > 0 && @object?.Guid != "localUtils")
+        if (Volatile.Read(ref _tracingCount) > 0 && frames.Count > 0 && @object?.Guid != "localUtils")
         {
             LocalUtils?.AddStackToTracingNoReply(frames, id);
         }