diff --git a/services/device/geolocation/location_arbitrator.cc b/services/device/geolocation/location_arbitrator.cc
index 20a99dc45005d7003c0b43bc929fbdf79ed0091f..c4f3ab6834e42345e66c36514d1e27f0d7f1383a 100644
--- a/services/device/geolocation/location_arbitrator.cc
+++ b/services/device/geolocation/location_arbitrator.cc
@@ -49,12 +49,14 @@ bool LocationArbitrator::HasPermissionBeenGrantedForTest() const {
 }
 
 void LocationArbitrator::OnPermissionGranted() {
+  base::AutoLock lock(lock_);
   is_permission_granted_ = true;
   for (const auto& provider : providers_)
     provider->OnPermissionGranted();
 }
 
 void LocationArbitrator::StartProvider(bool enable_high_accuracy) {
+  base::AutoLock lock(lock_);
   is_running_ = true;
   enable_high_accuracy_ = enable_high_accuracy;
 
@@ -65,6 +67,7 @@ void LocationArbitrator::StartProvider(bool enable_high_accuracy) {
 }
 
 void LocationArbitrator::DoStartProviders() {
+  base::AutoLock lock(lock_);
   if (providers_.empty()) {
     // If no providers are available, we report an error to avoid
     // callers waiting indefinitely for a reply.
@@ -91,6 +94,7 @@ void LocationArbitrator::StopProvider() {
 
 void LocationArbitrator::RegisterProvider(
     std::unique_ptr<LocationProvider> provider) {
+  base::AutoLock lock(lock_);
   if (!provider)
     return;
   provider->SetUpdateCallback(base::BindRepeating(
@@ -101,6 +105,7 @@ void LocationArbitrator::RegisterProvider(
 }
 
 void LocationArbitrator::RegisterProviders() {
+  base::AutoLock lock(lock_);
   if (custom_location_provider_getter_) {
     auto custom_provider = custom_location_provider_getter_.Run();
     if (custom_provider) {
@@ -122,6 +127,10 @@ void LocationArbitrator::RegisterProviders() {
 void LocationArbitrator::OnLocationUpdate(
     const LocationProvider* provider,
     mojom::GeopositionResultPtr new_result) {
+  base::AutoLock lock(lock_);
+  if (!is_running_) {
+    return;
+  }
   DCHECK(new_result);
   DCHECK(new_result->is_error() ||
          new_result->is_position() &&
@@ -136,6 +145,7 @@ void LocationArbitrator::OnLocationUpdate(
 }
 
 const mojom::GeopositionResult* LocationArbitrator::GetPosition() {
+  base::AutoLock lock(lock_);
   return result_.get();
 }
 
@@ -149,6 +159,7 @@ std::unique_ptr<LocationProvider>
 LocationArbitrator::NewNetworkLocationProvider(
     scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
     const std::string& api_key) {
+  base::AutoLock lock(lock_);
   DCHECK(url_loader_factory);
 #if BUILDFLAG(IS_ANDROID)
   // Android uses its own SystemLocationProvider.
@@ -162,6 +173,7 @@ LocationArbitrator::NewNetworkLocationProvider(
 
 std::unique_ptr<LocationProvider>
 LocationArbitrator::NewSystemLocationProvider() {
+  base::AutoLock lock(lock_);
 #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_FUCHSIA)
   return nullptr;
 #else
diff --git a/services/device/geolocation/location_arbitrator.h b/services/device/geolocation/location_arbitrator.h
index 819e8ae37c49aec677ddece024f5224705c032f7..67998506b7eab349ef0646c9ec0d03bd49723863 100644
--- a/services/device/geolocation/location_arbitrator.h
+++ b/services/device/geolocation/location_arbitrator.h
@@ -14,6 +14,7 @@
 #include "base/functional/callback_forward.h"
 #include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
+#include "base/synchronization/lock.h"
 #include "base/time/time.h"
 #include "services/device/geolocation/geolocation_provider_impl.h"
 #include "services/device/geolocation/network_location_provider.h"
@@ -119,6 +120,7 @@ class LocationArbitrator : public LocationProvider {
   // The current best estimate of our position, or `nullptr` if no estimate has
   // been received.
   mojom::GeopositionResultPtr result_;
+  base::Lock lock_;
 };
 
 // Factory functions for the various types of location provider to abstract