From 103097fbe395414a9608ad6a2d1d5add272d5114 Mon Sep 17 00:00:00 2001
From: Yury Semikhatsky <yurys@chromium.org>
Date: Fri, 16 Oct 2026 14:15:36 -0700
Subject: [PATCH 1/3] fix(threading): snapshot collection getters under the
 dispatch lock

Pages, ChildFrames, Workers, ServiceWorkers, Frames and Contexts now
return copies taken under Connection.DispatchLock, and the message pump
adds and removes elements under the same lock. Enumerating them while
the pump mutates them can no longer throw or observe a torn copy.
---
 src/Playwright/Core/Browser.cs           |  9 ++++---
 src/Playwright/Core/BrowserContext.cs    | 21 ++++++++++++-----
 src/Playwright/Core/BrowserType.cs       |  4 ++--
 src/Playwright/Core/Frame.cs             |  2 +-
 src/Playwright/Core/Page.cs              | 30 +++++++++++++++++-------
 src/Playwright/Core/Worker.cs            | 10 +++-----
 src/Playwright/Transport/ChannelOwner.cs | 10 ++++++++
 src/Playwright/Transport/Connection.cs   |  7 ++++++
 8 files changed, 65 insertions(+), 28 deletions(-)

diff --git a/src/Playwright/Core/Browser.cs b/src/Playwright/Core/Browser.cs
index e5e2b874d..384785c58 100644
--- a/src/Playwright/Core/Browser.cs
+++ b/src/Playwright/Core/Browser.cs
@@ -57,7 +57,7 @@ internal Browser(ChannelOwner parent, string guid, BrowserInitializer initialize
 
     public event EventHandler<IBrowserContext>? Context;
 
-    public IReadOnlyList<IBrowserContext> Contexts => _contexts.ToArray();
+    public IReadOnlyList<IBrowserContext> Contexts => Snapshot(_contexts);
 
     public bool IsConnected { get; private set; }
 
@@ -281,7 +281,7 @@ internal void ConnectToBrowserType(BrowserType browserType, string? tracesDir)
         // This is why browser type is not wired up in the constructor, and instead this separate method is called later on.
         _browserType = browserType;
         _tracesDir = tracesDir;
-        foreach (var context in _contexts)
+        foreach (var context in Snapshot(_contexts))
         {
             context._tracing._tracesDir = this._tracesDir;
             context._request._tracing._tracesDir = this._tracesDir;
@@ -292,7 +292,10 @@ internal void ConnectToBrowserType(BrowserType browserType, string? tracesDir)
     private void DidCreateContext(BrowserContext context)
     {
         context._browser = this;
-        _contexts.Add(context);
+        lock (_connection.DispatchLock)
+        {
+            _contexts.Add(context);
+        }
         // Note: when connecting to a browser, initial contexts arrive before `_browserType` is set,
         // and will be configured later in `ConnectToBrowserType`.
         if (_browserType != null)
diff --git a/src/Playwright/Core/BrowserContext.cs b/src/Playwright/Core/BrowserContext.cs
index 6f41d2d44..41e708969 100644
--- a/src/Playwright/Core/BrowserContext.cs
+++ b/src/Playwright/Core/BrowserContext.cs
@@ -159,7 +159,7 @@ public event EventHandler<IRequest> RequestFailed
 
     public IBrowser? Browser => _browser;
 
-    public IReadOnlyList<IPage> Pages => _pages;
+    public IReadOnlyList<IPage> Pages => Snapshot(_pages);
 
     internal Page? OwnerPage { get; set; }
 
@@ -173,7 +173,7 @@ public event EventHandler<IRequest> RequestFailed
 
     public IAPIRequestContext APIRequest => _request;
 
-    public IReadOnlyList<IWorker> ServiceWorkers => _serviceWorkers;
+    public IReadOnlyList<IWorker> ServiceWorkers => Snapshot(_serviceWorkers);
 
     public IReadOnlyList<IPage> BackgroundPages => new List<IPage>();
 
@@ -245,7 +245,10 @@ internal override void OnMessage(string method, JsonElement serverParams)
                 {
                     var serviceWorker = serverParams.GetProperty("worker").ToObject<Worker>(_connection.DefaultJsonSerializerOptions)!;
                     ((Worker)serviceWorker).Context = this;
-                    _serviceWorkers.Add(serviceWorker);
+                    lock (_connection.DispatchLock)
+                    {
+                        _serviceWorkers.Add(serviceWorker);
+                    }
                     ServiceWorker?.Invoke(this, serviceWorker);
                     break;
                 }
@@ -858,7 +861,10 @@ internal void OnClose()
         ClosingOrClosed = true;
         if (Browser != null)
         {
-            ((Browser)Browser)._contexts.Remove(this);
+            lock (_connection.DispatchLock)
+            {
+                ((Browser)Browser)._contexts.Remove(this);
+            }
             ((Browser)Browser)._browserType.Playwright._selectors._contextsForSelectors.Remove(this);
         }
 
@@ -884,7 +890,10 @@ internal void OnClose()
     private void Channel_OnPage(object sender, Page page)
     {
         page.Context = this;
-        _pages.Add(page);
+        lock (_connection.DispatchLock)
+        {
+            _pages.Add(page);
+        }
         Page?.Invoke(this, page);
 
         if (page.Opener?.IsClosed == false)
@@ -905,7 +914,7 @@ private void Channel_BindingCall(BindingCall bindingCall)
 
     private async Task<IAsyncDisposable> ExposeBindingAsync(string name, Delegate callback)
     {
-        foreach (var page in _pages)
+        foreach (var page in Snapshot(_pages))
         {
             if (page.Bindings.ContainsKey(name))
             {
diff --git a/src/Playwright/Core/BrowserType.cs b/src/Playwright/Core/BrowserType.cs
index 18a81c90e..cdb4d6011 100644
--- a/src/Playwright/Core/BrowserType.cs
+++ b/src/Playwright/Core/BrowserType.cs
@@ -187,9 +187,9 @@ void ClosePipe()
         void OnPipeClosed(string? reason = null)
         {
             // Emulate all pages, contexts and the browser closing upon disconnect.
-            foreach (BrowserContext context in browser?._contexts.ToArray() ?? Array.Empty<BrowserContext>())
+            foreach (BrowserContext context in browser?.Snapshot(browser._contexts) ?? Array.Empty<BrowserContext>())
             {
-                foreach (Page page in context._pages.ToArray())
+                foreach (Page page in context.Snapshot(context._pages))
                 {
                     page.OnClose();
                 }
diff --git a/src/Playwright/Core/Frame.cs b/src/Playwright/Core/Frame.cs
index ee9551cf4..bdfbc3f60 100644
--- a/src/Playwright/Core/Frame.cs
+++ b/src/Playwright/Core/Frame.cs
@@ -64,7 +64,7 @@ internal Frame(ChannelOwner parent, string guid, FrameInitializer initializer) :
     /// </summary>
     public event EventHandler<WaitUntilState>? LoadState;
 
-    public IReadOnlyList<IFrame> ChildFrames => _childFrames;
+    public IReadOnlyList<IFrame> ChildFrames => Snapshot(_childFrames);
 
     public string Name { get; internal set; }
 
diff --git a/src/Playwright/Core/Page.cs b/src/Playwright/Core/Page.cs
index d15d98121..645c1e783 100644
--- a/src/Playwright/Core/Page.cs
+++ b/src/Playwright/Core/Page.cs
@@ -195,7 +195,7 @@ public IMouse Mouse
 
     public string Url => MainFrame.Url;
 
-    public IReadOnlyList<IFrame> Frames => _frames.ToList().AsReadOnly();
+    public IReadOnlyList<IFrame> Frames => Snapshot(_frames);
 
     public IKeyboard Keyboard { get; }
 
@@ -207,7 +207,7 @@ public IMouse Mouse
 
     public IWebStorage SessionStorage { get; }
 
-    public IReadOnlyList<IWorker> Workers => _workers;
+    public IReadOnlyList<IWorker> Workers => Snapshot(_workers);
 
     public IVideo? Video
     {
@@ -287,7 +287,10 @@ internal override void OnMessage(string method, JsonElement serverParams)
                 break;
             case "worker":
                 var worker = serverParams.GetProperty("worker").ToObject<Worker>(_connection.DefaultJsonSerializerOptions);
-                _workers.Add(worker);
+                lock (_connection.DispatchLock)
+                {
+                    _workers.Add(worker);
+                }
                 worker.Page = this;
                 Worker?.Invoke(this, worker);
                 break;
@@ -1338,7 +1341,10 @@ private async Task UpdateInterceptionAsync()
     internal void OnClose()
     {
         IsClosed = true;
-        Context._pages.Remove(this);
+        lock (_connection.DispatchLock)
+        {
+            Context._pages.Remove(this);
+        }
         DisposeHarRouters();
         Close?.Invoke(this, this);
         Context?.FirePageClose(this);
@@ -1411,9 +1417,12 @@ private async Task OnWebSocketRouteAsync(WebSocketRoute webSocketRoute)
     private void Channel_FrameDetached(object sender, IFrame args)
     {
         var frame = (Frame)args;
-        _frames.Remove(frame);
-        frame.IsDetached = true;
-        frame.ParentFrame?._childFrames?.Remove(frame);
+        lock (_connection.DispatchLock)
+        {
+            _frames.Remove(frame);
+            frame.IsDetached = true;
+            frame.ParentFrame?._childFrames?.Remove(frame);
+        }
         FrameDetached?.Invoke(this, args);
         Context?.FireFrameDetached(args);
     }
@@ -1422,8 +1431,11 @@ private void Channel_FrameAttached(object sender, IFrame args)
     {
         var frame = (Frame)args;
         frame.Page = this;
-        _frames.Add(frame);
-        frame.ParentFrame?._childFrames?.Add(frame);
+        lock (_connection.DispatchLock)
+        {
+            _frames.Add(frame);
+            frame.ParentFrame?._childFrames?.Add(frame);
+        }
         FrameAttached?.Invoke(this, args);
         Context?.FireFrameAttached(args);
     }
diff --git a/src/Playwright/Core/Worker.cs b/src/Playwright/Core/Worker.cs
index ecf98b656..fdb906c05 100644
--- a/src/Playwright/Core/Worker.cs
+++ b/src/Playwright/Core/Worker.cs
@@ -75,14 +75,10 @@ internal override void OnMessage(string method, JsonElement serverParams)
 
     internal void OnClose()
     {
-        if (Page != null)
+        lock (_connection.DispatchLock)
         {
-            Page._workers.Remove(this);
-        }
-
-        if (Context != null)
-        {
-            Context._serviceWorkers.Remove(this);
+            Page?._workers.Remove(this);
+            Context?._serviceWorkers.Remove(this);
         }
 
         Close?.Invoke(this, this);
diff --git a/src/Playwright/Transport/ChannelOwner.cs b/src/Playwright/Transport/ChannelOwner.cs
index b815b2d8b..8cfb3a58c 100644
--- a/src/Playwright/Transport/ChannelOwner.cs
+++ b/src/Playwright/Transport/ChannelOwner.cs
@@ -64,6 +64,16 @@ internal virtual void OnMessage(string method, JsonElement serverParams)
     {
     }
 
+    // Copies a list that the message pump mutates under the dispatch lock. Getters return the
+    // copy, and code that iterates outside the lock iterates the copy.
+    internal T[] Snapshot<T>(List<T> list)
+    {
+        lock (_connection.DispatchLock)
+        {
+            return list.ToArray();
+        }
+    }
+
     internal void Adopt(ChannelOwner child)
     {
         child.Parent!.Objects.TryRemove(child.Guid, out _);
diff --git a/src/Playwright/Transport/Connection.cs b/src/Playwright/Transport/Connection.cs
index ba8ab3745..cc6c2d24e 100644
--- a/src/Playwright/Transport/Connection.cs
+++ b/src/Playwright/Transport/Connection.cs
@@ -52,6 +52,13 @@ internal class Connection : IDisposable
     private readonly Root _rootObject;
     private readonly TaskQueue _queue = new();
     private readonly string _callIdPrefix = CreateCallIdPrefix();
+
+    // Taken by the message pump around every write to client-side state that user code reads
+    // (the lists of pages, frames, workers and contexts; the route, binding and handler
+    // registries) and by every reader of that state. Critical sections are synchronous and
+    // never run user code, so the lock is never held across an await.
+    internal readonly object DispatchLock = new();
+
     private int _tracingCount;
     private int _lastId;
     private Exception? _closedError;

From 2b62f9dc55af2163528b78e0db72b1810d5ec940 Mon Sep 17 00:00:00 2001
From: Yury Semikhatsky <yurys@chromium.org>
Date: Fri, 16 Oct 2026 14:22:27 -0700
Subject: [PATCH 2/3] test(threading): enumerate Pages and ChildFrames while
 they change

Both loops threw "Collection was modified" when the getters handed out
the live lists.
---
 src/Playwright.Tests/BrowserContextBasicTests.cs | 14 ++++++++++++++
 src/Playwright.Tests/FrameHierarchyTests.cs      | 14 ++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/src/Playwright.Tests/BrowserContextBasicTests.cs b/src/Playwright.Tests/BrowserContextBasicTests.cs
index c0f352b7e..7df78b389 100644
--- a/src/Playwright.Tests/BrowserContextBasicTests.cs
+++ b/src/Playwright.Tests/BrowserContextBasicTests.cs
@@ -312,4 +312,18 @@ public async Task ShouldEmulateNavigatorOnLine()
         await context.SetOfflineAsync(false);
         Assert.True(await page.EvaluateAsync<bool>("() => window.navigator.onLine"));
     }
+
+    [PlaywrightTest]
+    public async Task ShouldAllowOpeningPagesWhileEnumeratingPages()
+    {
+        // Pages used to hand out the live list, so a page opened from inside the loop made the
+        // next MoveNext throw "Collection was modified".
+        await using var context = await Browser.NewContextAsync();
+        await context.NewPageAsync();
+        foreach (var page in context.Pages)
+        {
+            await context.NewPageAsync();
+        }
+        Assert.AreEqual(2, context.Pages.Count);
+    }
 }
diff --git a/src/Playwright.Tests/FrameHierarchyTests.cs b/src/Playwright.Tests/FrameHierarchyTests.cs
index eeb6e8dcb..8b4f0b365 100644
--- a/src/Playwright.Tests/FrameHierarchyTests.cs
+++ b/src/Playwright.Tests/FrameHierarchyTests.cs
@@ -209,4 +209,18 @@ await Page.EvaluateAsync(@"() => {
         Assert.False(frame2.IsDetached);
         Assert.That(frame1, Is.Not.EqualTo(frame2));
     }
+
+    [PlaywrightTest]
+    public async Task ShouldAllowAttachingFramesWhileEnumeratingChildFrames()
+    {
+        // ChildFrames used to hand out the live list, so a frame attached from inside the loop
+        // made the next MoveNext throw "Collection was modified".
+        await Page.GotoAsync(Server.EmptyPage);
+        await FrameUtils.AttachFrameAsync(Page, "frame1", Server.EmptyPage);
+        foreach (var frame in Page.MainFrame.ChildFrames)
+        {
+            await FrameUtils.AttachFrameAsync(Page, "frame2", Server.EmptyPage);
+        }
+        Assert.AreEqual(2, Page.MainFrame.ChildFrames.Count);
+    }
 }

From 84d33c0e1ad927456c880b4a947ee9e78941f84b Mon Sep 17 00:00:00 2001
From: Yury Semikhatsky <yurys@chromium.org>
Date: Fri, 16 Oct 2026 14:22:27 -0700
Subject: [PATCH 3/3] fix(threading): guard route, binding and handler
 registries with the dispatch lock

Routes, bindings, locator handlers, WebSocket routes, HAR routers and
CDP session events are written by the caller and read by the pump or
by pool threads. Both sides now take Connection.DispatchLock. The route
Times count moves under the same lock as the expiry check, so two
matching requests handled concurrently cannot both pass it, and the
tracing counter uses Interlocked.
---
 src/Playwright/Core/BrowserContext.cs  | 115 ++++++++++++++------
 src/Playwright/Core/CDPSession.cs      |  19 ++--
 src/Playwright/Core/Page.cs            | 141 ++++++++++++++++++-------
 src/Playwright/Core/RouteHandler.cs    |   3 +-
 src/Playwright/Transport/Connection.cs |   6 +-
 5 files changed, 198 insertions(+), 86 deletions(-)

diff --git a/src/Playwright/Core/BrowserContext.cs b/src/Playwright/Core/BrowserContext.cs
index 41e708969..a67bbff77 100644
--- a/src/Playwright/Core/BrowserContext.cs
+++ b/src/Playwright/Core/BrowserContext.cs
@@ -732,7 +732,7 @@ internal async Task OnRouteAsync(Route route)
     {
         route._context = this;
         var page = route._request.SafePage;
-        var routeHandlers = _routes.ToArray();
+        var routeHandlers = Snapshot(_routes);
         foreach (var routeHandler in routeHandlers)
         {
             // If the page or the context was closed we stall all requests right away.
@@ -744,16 +744,24 @@ internal async Task OnRouteAsync(Route route)
             {
                 continue;
             }
-            if (!_routes.Contains(routeHandler))
-            {
-                continue;
-            }
-            if (routeHandler.WillExpire())
+            bool noRoutesLeft;
+            lock (_connection.DispatchLock)
             {
-                _routes.Remove(routeHandler);
+                if (!_routes.Contains(routeHandler))
+                {
+                    continue;
+                }
+                if (routeHandler.WillExpire())
+                {
+                    _routes.Remove(routeHandler);
+                }
+                // Counted here, under the lock, rather than in HandleAsync: two matching requests
+                // handled concurrently must not both see the count before the other's increment.
+                routeHandler.HandledCount++;
+                noRoutesLeft = _routes.Count == 0;
             }
             var handled = await routeHandler.HandleAsync(route).ConfigureAwait(false);
-            if (_routes.Count == 0)
+            if (noRoutesLeft)
             {
                 UpdateInterceptionAsync().IgnoreException();
             }
@@ -776,7 +784,7 @@ internal async Task OnRouteAsync(Route route)
 
     internal async Task OnWebSocketRouteAsync(WebSocketRoute webSocketRoute)
     {
-        var routeHandler = _webSocketRoutes.Find(route => route.Matches(webSocketRoute.Url));
+        var routeHandler = Array.Find(Snapshot(_webSocketRoutes), route => route.Matches(webSocketRoute.Url));
         if (routeHandler != null)
         {
             await routeHandler.HandleAsync(webSocketRoute).ConfigureAwait(false);
@@ -808,7 +816,10 @@ private async Task<IAsyncDisposable> RouteAsync(string? globMatch, Regex? reMatc
             Handler = handler,
             Times = options?.Times,
         };
-        _routes.Insert(0, setting);
+        lock (_connection.DispatchLock)
+        {
+            _routes.Insert(0, setting);
+        }
         await UpdateInterceptionAsync().ConfigureAwait(false);
         return new DisposableStub(async () =>
         {
@@ -820,15 +831,18 @@ private async Task UnrouteAsync(string? globMatch, Regex? reMatch, Func<string,
     {
         var removed = new List<RouteHandler>();
         var remaining = new List<RouteHandler>();
-        foreach (var routeHandler in _routes)
+        lock (_connection.DispatchLock)
         {
-            if (routeHandler.urlMatcher.Equals(globMatch, reMatch, funcMatch, BaseURL, false) && (handler == null || routeHandler.Handler == handler))
-            {
-                removed.Add(routeHandler);
-            }
-            else
+            foreach (var routeHandler in _routes)
             {
-                remaining.Add(routeHandler);
+                if (routeHandler.urlMatcher.Equals(globMatch, reMatch, funcMatch, BaseURL, false) && (handler == null || routeHandler.Handler == handler))
+                {
+                    removed.Add(routeHandler);
+                }
+                else
+                {
+                    remaining.Add(routeHandler);
+                }
             }
         }
         await UnrouteInternalAsync(removed, remaining, UnrouteBehavior.Default).ConfigureAwait(false);
@@ -836,7 +850,10 @@ private async Task UnrouteAsync(string? globMatch, Regex? reMatch, Func<string,
 
     private async Task UnrouteInternalAsync(List<RouteHandler> removed, List<RouteHandler> remaining, UnrouteBehavior? behavior)
     {
-        _routes = remaining;
+        lock (_connection.DispatchLock)
+        {
+            _routes = remaining;
+        }
         if (behavior != null && behavior != UnrouteBehavior.Default)
         {
             var tasks = removed.Select(routeHandler => routeHandler.StopAsync(behavior.Value));
@@ -847,7 +864,11 @@ private async Task UnrouteInternalAsync(List<RouteHandler> removed, List<RouteHa
 
     private async Task UpdateInterceptionAsync()
     {
-        var patterns = RouteHandler.PrepareInterceptionPatterns(_routes);
+        List<Dictionary<string, object>> patterns;
+        lock (_connection.DispatchLock)
+        {
+            patterns = RouteHandler.PrepareInterceptionPatterns(_routes);
+        }
         await SendMessageToServerAsync(
             "setNetworkInterceptionPatterns",
             new Dictionary<string, object?>
@@ -904,7 +925,12 @@ private void Channel_OnPage(object sender, Page page)
 
     private void Channel_BindingCall(BindingCall bindingCall)
     {
-        if (_bindings.TryGetValue(bindingCall.Name, out var binding))
+        Delegate? binding;
+        lock (_connection.DispatchLock)
+        {
+            _bindings.TryGetValue(bindingCall.Name, out binding);
+        }
+        if (binding != null)
         {
             _ = bindingCall.CallAsync(binding);
         }
@@ -914,20 +940,23 @@ private void Channel_BindingCall(BindingCall bindingCall)
 
     private async Task<IAsyncDisposable> ExposeBindingAsync(string name, Delegate callback)
     {
-        foreach (var page in Snapshot(_pages))
+        lock (_connection.DispatchLock)
         {
-            if (page.Bindings.ContainsKey(name))
+            foreach (var page in _pages)
             {
-                throw new PlaywrightException($"Function \"{name}\" has been already registered in one of the pages");
+                if (page.Bindings.ContainsKey(name))
+                {
+                    throw new PlaywrightException($"Function \"{name}\" has been already registered in one of the pages");
+                }
             }
-        }
 
-        if (_bindings.ContainsKey(name))
-        {
-            throw new PlaywrightException($"Function \"{name}\" has been already registered");
-        }
+            if (_bindings.ContainsKey(name))
+            {
+                throw new PlaywrightException($"Function \"{name}\" has been already registered");
+            }
 
-        _bindings.Add(name, callback);
+            _bindings.Add(name, callback);
+        }
 
         var result = await SendMessageToServerAsync(
             "exposeBinding",
@@ -968,17 +997,25 @@ public async Task RouteFromHARAsync(string har, BrowserContextRouteFromHAROption
             UrlRegex = options?.UrlRegex,
             UrlString = options?.UrlString,
         }).ConfigureAwait(false);
-        _harRouters.Add(harRouter);
+        lock (_connection.DispatchLock)
+        {
+            _harRouters.Add(harRouter);
+        }
         await harRouter.AddContextRouteAsync(this).ConfigureAwait(false);
     }
 
     private void DisposeHarRouters()
     {
-        foreach (var router in _harRouters)
+        HarRouter[] routers;
+        lock (_connection.DispatchLock)
+        {
+            routers = _harRouters.ToArray();
+            _harRouters.Clear();
+        }
+        foreach (var router in routers)
         {
             router.Dispose();
         }
-        _harRouters.Clear();
     }
 
     [MethodImpl(MethodImplOptions.NoInlining)]
@@ -995,7 +1032,7 @@ public Task RouteWebSocketAsync(Func<string, bool> url, Action<IWebSocketRoute>
 
     private Task RouteWebSocketAsync(string? globMatch, Regex? reMatch, Func<string, bool>? funcMatch, Delegate handler)
     {
-        _webSocketRoutes.Insert(0, new WebSocketRouteHandler()
+        var routeHandler = new WebSocketRouteHandler()
         {
             urlMatcher = new URLMatch()
             {
@@ -1006,13 +1043,21 @@ private Task RouteWebSocketAsync(string? globMatch, Regex? reMatch, Func<string,
                 isWebSocketUrl = true,
             },
             Handler = handler,
-        });
+        };
+        lock (_connection.DispatchLock)
+        {
+            _webSocketRoutes.Insert(0, routeHandler);
+        }
         return UpdateWebSocketInterceptionAsync();
     }
 
     private async Task UpdateWebSocketInterceptionAsync()
     {
-        var patterns = WebSocketRouteHandler.PrepareInterceptionPatterns(_webSocketRoutes);
+        List<Dictionary<string, object>> patterns;
+        lock (_connection.DispatchLock)
+        {
+            patterns = WebSocketRouteHandler.PrepareInterceptionPatterns(_webSocketRoutes);
+        }
         await SendMessageToServerAsync("setWebSocketInterceptionPatterns", new Dictionary<string, object?>
         {
             ["patterns"] = patterns,
diff --git a/src/Playwright/Core/CDPSession.cs b/src/Playwright/Core/CDPSession.cs
index 9f508fb5e..82f0dd64d 100644
--- a/src/Playwright/Core/CDPSession.cs
+++ b/src/Playwright/Core/CDPSession.cs
@@ -73,23 +73,24 @@ internal override void OnMessage(string method, JsonElement serverParams)
 
     private void OnCDPEvent(string name, JsonElement? @params)
     {
-        if (_cdpSessionEvents.TryGetValue(name, out var cdpNamedEvent))
+        CDPSessionEvent? cdpNamedEvent;
+        lock (_connection.DispatchLock)
         {
-            cdpNamedEvent.RaiseEvent(@params);
+            _cdpSessionEvents.TryGetValue(name, out cdpNamedEvent);
         }
+        cdpNamedEvent?.RaiseEvent(@params);
     }
 
     [MethodImpl(MethodImplOptions.NoInlining)]
     public ICDPSessionEvent Event(string eventName)
     {
-        if (_cdpSessionEvents.TryGetValue(eventName, out var cdpNamedEvent))
+        lock (_connection.DispatchLock)
         {
-            return cdpNamedEvent;
-        }
-        else
-        {
-            cdpNamedEvent = new(eventName);
-            _cdpSessionEvents.Add(eventName, cdpNamedEvent);
+            if (!_cdpSessionEvents.TryGetValue(eventName, out var cdpNamedEvent))
+            {
+                cdpNamedEvent = new(eventName);
+                _cdpSessionEvents.Add(eventName, cdpNamedEvent);
+            }
             return cdpNamedEvent;
         }
     }
diff --git a/src/Playwright/Core/Page.cs b/src/Playwright/Core/Page.cs
index 645c1e783..b89ef71f0 100644
--- a/src/Playwright/Core/Page.cs
+++ b/src/Playwright/Core/Page.cs
@@ -1291,7 +1291,10 @@ private async Task<IAsyncDisposable> RouteAsync(string? globMatch, Regex? reMatc
             Handler = handler,
             Times = options?.Times,
         };
-        _routes.Insert(0, setting);
+        lock (_connection.DispatchLock)
+        {
+            _routes.Insert(0, setting);
+        }
         await UpdateInterceptionAsync().ConfigureAwait(false);
         return new DisposableStub(async () =>
         {
@@ -1303,15 +1306,18 @@ private async Task UnrouteAsync(string? globMatch, Regex? reMatch, Func<string,
     {
         var removed = new List<RouteHandler>();
         var remaining = new List<RouteHandler>();
-        foreach (var routeHandler in _routes)
+        lock (_connection.DispatchLock)
         {
-            if (routeHandler.urlMatcher.Equals(globMatch, reMatch, funcMatch, Context.BaseURL, false) && (handler == null || routeHandler.Handler == handler))
+            foreach (var routeHandler in _routes)
             {
-                removed.Add(routeHandler);
-            }
-            else
-            {
-                remaining.Add(routeHandler);
+                if (routeHandler.urlMatcher.Equals(globMatch, reMatch, funcMatch, Context.BaseURL, false) && (handler == null || routeHandler.Handler == handler))
+                {
+                    removed.Add(routeHandler);
+                }
+                else
+                {
+                    remaining.Add(routeHandler);
+                }
             }
         }
         await UnrouteInternalAsync(removed, remaining, UnrouteBehavior.Default).ConfigureAwait(false);
@@ -1319,7 +1325,10 @@ private async Task UnrouteAsync(string? globMatch, Regex? reMatch, Func<string,
 
     private async Task UnrouteInternalAsync(List<RouteHandler> removed, List<RouteHandler> remaining, UnrouteBehavior? behavior)
     {
-        _routes = remaining;
+        lock (_connection.DispatchLock)
+        {
+            _routes = remaining;
+        }
         if (behavior != null && behavior != UnrouteBehavior.Default)
         {
             var tasks = removed.Select(routeHandler => routeHandler.StopAsync(behavior.Value));
@@ -1331,7 +1340,11 @@ private async Task UnrouteInternalAsync(List<RouteHandler> removed, List<RouteHa
 
     private async Task UpdateInterceptionAsync()
     {
-        var patterns = RouteHandler.PrepareInterceptionPatterns(_routes);
+        List<Dictionary<string, object>> patterns;
+        lock (_connection.DispatchLock)
+        {
+            patterns = RouteHandler.PrepareInterceptionPatterns(_routes);
+        }
         await SendMessageToServerAsync("setNetworkInterceptionPatterns", new Dictionary<string, object?>
         {
             ["patterns"] = patterns,
@@ -1357,7 +1370,12 @@ private void Channel_Crashed()
 
     private void Channel_BindingCall(object sender, BindingCall bindingCall)
     {
-        if (Bindings.TryGetValue(bindingCall.Name, out var binding))
+        Delegate? binding;
+        lock (_connection.DispatchLock)
+        {
+            Bindings.TryGetValue(bindingCall.Name, out binding);
+        }
+        if (binding != null)
         {
             _ = bindingCall.CallAsync(binding);
         }
@@ -1368,7 +1386,7 @@ private void Channel_BindingCall(object sender, BindingCall bindingCall)
     private async Task OnRouteAsync(Route route)
     {
         route._context = Context;
-        foreach (var routeHandler in _routes.ToArray())
+        foreach (var routeHandler in Snapshot(_routes))
         {
             // If the page was closed we stall all requests right away.
             if (CloseWasCalled || Context.ClosingOrClosed)
@@ -1379,16 +1397,24 @@ private async Task OnRouteAsync(Route route)
             {
                 continue;
             }
-            if (!_routes.Contains(routeHandler))
-            {
-                continue;
-            }
-            if (routeHandler.WillExpire())
+            bool noRoutesLeft;
+            lock (_connection.DispatchLock)
             {
-                _routes.Remove(routeHandler);
+                if (!_routes.Contains(routeHandler))
+                {
+                    continue;
+                }
+                if (routeHandler.WillExpire())
+                {
+                    _routes.Remove(routeHandler);
+                }
+                // Counted here, under the lock, rather than in HandleAsync: two matching requests
+                // handled concurrently must not both see the count before the other's increment.
+                routeHandler.HandledCount++;
+                noRoutesLeft = _routes.Count == 0;
             }
             var handled = await routeHandler.HandleAsync(route).ConfigureAwait(false);
-            if (_routes.Count == 0)
+            if (noRoutesLeft)
             {
                 UpdateInterceptionAsync().IgnoreException();
             }
@@ -1403,7 +1429,7 @@ private async Task OnRouteAsync(Route route)
 
     private async Task OnWebSocketRouteAsync(WebSocketRoute webSocketRoute)
     {
-        var routeHandler = _webSocketRoutes.Find(route => route.Matches(webSocketRoute.Url));
+        var routeHandler = Array.Find(Snapshot(_webSocketRoutes), route => route.Matches(webSocketRoute.Url));
         if (routeHandler != null)
         {
             await routeHandler.HandleAsync(webSocketRoute).ConfigureAwait(false);
@@ -1442,12 +1468,15 @@ private void Channel_FrameAttached(object sender, IFrame args)
 
     private async Task<IAsyncDisposable> InnerExposeBindingAsync(string name, Delegate callback)
     {
-        if (Bindings.ContainsKey(name))
+        lock (_connection.DispatchLock)
         {
-            throw new PlaywrightException($"Function \"{name}\" has been already registered");
-        }
+            if (Bindings.ContainsKey(name))
+            {
+                throw new PlaywrightException($"Function \"{name}\" has been already registered");
+            }
 
-        Bindings.Add(name, callback);
+            Bindings.Add(name, callback);
+        }
 
         var result = await SendMessageToServerAsync(
             "exposeBinding",
@@ -1500,17 +1529,25 @@ await Context.RecordIntoHarAsync(
             Url = options?.Url,
             UrlString = options?.UrlString,
         }).ConfigureAwait(false);
-        _harRouters.Add(harRouter);
+        lock (_connection.DispatchLock)
+        {
+            _harRouters.Add(harRouter);
+        }
         await harRouter.AddPageRouteAsync(this).ConfigureAwait(false);
     }
 
     private void DisposeHarRouters()
     {
-        foreach (var router in _harRouters)
+        HarRouter[] routers;
+        lock (_connection.DispatchLock)
+        {
+            routers = _harRouters.ToArray();
+            _harRouters.Clear();
+        }
+        foreach (var router in routers)
         {
             router.Dispose();
         }
-        _harRouters.Clear();
     }
 
     [MethodImpl(MethodImplOptions.NoInlining)]
@@ -1649,7 +1686,10 @@ private async Task AddLocatorHandlerImplAsync(ILocator locator, object handler,
             ["noWaitAfter"] = options?.NoWaitAfter,
         }).ConfigureAwait(false);
 
-        _locatorHandlers.Add(response!.Value.GetProperty("uid").GetInt32(), new LocatorHandler((Locator)locator, handler, options?.Times));
+        lock (_connection.DispatchLock)
+        {
+            _locatorHandlers.Add(response!.Value.GetProperty("uid").GetInt32(), new LocatorHandler((Locator)locator, handler, options?.Times));
+        }
     }
 
     private async Task Channel_LocatorHandlerTriggeredAsync(int uid)
@@ -1657,24 +1697,33 @@ private async Task Channel_LocatorHandlerTriggeredAsync(int uid)
         var remove = false;
         try
         {
-            if (_locatorHandlers.TryGetValue(uid, out var handler))
+            LocatorHandler? handler;
+            var shouldHandle = false;
+            lock (_connection.DispatchLock)
             {
-                if (handler.Times != 0)
+                if (_locatorHandlers.TryGetValue(uid, out handler) && handler.Times != 0)
                 {
                     if (handler.Times != null)
                     {
                         handler.Times--;
                     }
-                    await handler.HandleAsync().ConfigureAwait(false);
+                    shouldHandle = true;
                 }
-                remove = handler.Times == 0;
             }
+            if (shouldHandle)
+            {
+                await handler!.HandleAsync().ConfigureAwait(false);
+            }
+            remove = handler?.Times == 0;
         }
         finally
         {
             if (remove)
             {
-                _locatorHandlers.Remove(uid);
+                lock (_connection.DispatchLock)
+                {
+                    _locatorHandlers.Remove(uid);
+                }
             }
             SendMessageToServerAsync("resolveLocatorHandlerNoReply", new Dictionary<string, object?>
             {
@@ -1686,12 +1735,20 @@ private async Task Channel_LocatorHandlerTriggeredAsync(int uid)
 
     public async Task RemoveLocatorHandlerAsync(ILocator locator)
     {
-        foreach (KeyValuePair<int, LocatorHandler> entry in _locatorHandlers)
+        KeyValuePair<int, LocatorHandler>[] entries;
+        lock (_connection.DispatchLock)
+        {
+            entries = _locatorHandlers.ToArray();
+        }
+        foreach (var entry in entries)
         {
             var (uid, data) = (entry.Key, entry.Value);
             if (data.Locator.EqualLocator((Locator)locator))
             {
-                _locatorHandlers.Remove(uid);
+                lock (_connection.DispatchLock)
+                {
+                    _locatorHandlers.Remove(uid);
+                }
                 try
                 {
                     await SendMessageToServerAsync("unregisterLocatorHandler", new Dictionary<string, object?>
@@ -1721,7 +1778,7 @@ public Task RouteWebSocketAsync(Func<string, bool> url, Action<IWebSocketRoute>
 
     private Task RouteWebSocketAsync(string? globMatch, Regex? urlRegex, Func<string, bool>? urlFunc, Delegate handler)
     {
-        _webSocketRoutes.Insert(0, new WebSocketRouteHandler()
+        var routeHandler = new WebSocketRouteHandler()
         {
             urlMatcher = new URLMatch()
             {
@@ -1732,13 +1789,21 @@ private Task RouteWebSocketAsync(string? globMatch, Regex? urlRegex, Func<string
                 isWebSocketUrl = true,
             },
             Handler = handler,
-        });
+        };
+        lock (_connection.DispatchLock)
+        {
+            _webSocketRoutes.Insert(0, routeHandler);
+        }
         return UpdateWebSocketInterceptionAsync();
     }
 
     private async Task UpdateWebSocketInterceptionAsync()
     {
-        var patterns = WebSocketRouteHandler.PrepareInterceptionPatterns(_webSocketRoutes);
+        List<Dictionary<string, object>> patterns;
+        lock (_connection.DispatchLock)
+        {
+            patterns = WebSocketRouteHandler.PrepareInterceptionPatterns(_webSocketRoutes);
+        }
         await SendMessageToServerAsync("setWebSocketInterceptionPatterns", new Dictionary<string, object?>
         {
             ["patterns"] = patterns,
diff --git a/src/Playwright/Core/RouteHandler.cs b/src/Playwright/Core/RouteHandler.cs
index 654068788..70eca0e19 100644
--- a/src/Playwright/Core/RouteHandler.cs
+++ b/src/Playwright/Core/RouteHandler.cs
@@ -42,6 +42,8 @@ internal class RouteHandler
 
     public int? Times { get; internal set; }
 
+    // Incremented by the owning page or context under the dispatch lock, together with the
+    // WillExpire() check, so that matching requests handled concurrently see each other.
     public int HandledCount { get; set; }
 
     public static List<Dictionary<string, object>> PrepareInterceptionPatterns(List<RouteHandler> handlers)
@@ -138,7 +140,6 @@ public async Task StopAsync(UnrouteBehavior behavior)
 
     private async Task<bool> HandleInternalAsync(Route route)
     {
-        ++HandledCount;
         var handledTask = route.StartHandlingAsync();
         var maybeTask = Handler.DynamicInvoke(new object[] { route });
         if (maybeTask is Task task)
diff --git a/src/Playwright/Transport/Connection.cs b/src/Playwright/Transport/Connection.cs
index cc6c2d24e..709502102 100644
--- a/src/Playwright/Transport/Connection.cs
+++ b/src/Playwright/Transport/Connection.cs
@@ -125,11 +125,11 @@ internal void SetIsTracing(bool isTracing)
     {
         if (isTracing)
         {
-            _tracingCount++;
+            Interlocked.Increment(ref _tracingCount);
         }
         else
         {
-            _tracingCount--;
+            Interlocked.Decrement(ref _tracingCount);
         }
     }
 
@@ -211,7 +211,7 @@ private async Task<T> InnerSendMessageToServerAsync<T>(
             };
         }
 
-        if (_tracingCount > 0 && frames.Count > 0 && @object?.Guid != "localUtils")
+        if (Volatile.Read(ref _tracingCount) > 0 && frames.Count > 0 && @object?.Guid != "localUtils")
         {
             LocalUtils?.AddStackToTracingNoReply(frames, id);
         }