diff --git a/chromium-94.0.4606.71-InkDropHost-crash.patch b/chromium-94.0.4606.71-InkDropHost-crash.patch
new file mode 100644
index 00000000..b5e27949
--- /dev/null
+++ b/chromium-94.0.4606.71-InkDropHost-crash.patch
@@ -0,0 +1,24 @@
+diff -up chromium-94.0.4606.71/ui/views/animation/ink_drop_host_view.h.InkDropHost-crash chromium-94.0.4606.71/ui/views/animation/ink_drop_host_view.h
+--- chromium-94.0.4606.71/ui/views/animation/ink_drop_host_view.h.InkDropHost-crash	2021-10-05 16:04:46.313586509 -0400
++++ chromium-94.0.4606.71/ui/views/animation/ink_drop_host_view.h	2021-10-05 16:05:12.213732558 -0400
+@@ -228,6 +228,11 @@ class VIEWS_EXPORT InkDropHost {
+   // Used to observe View and inform the InkDrop of host-transform changes.
+   ViewLayerTransformObserver host_view_transform_observer_;
+ 
++  // Declared before |ink_drop_|, because InkDropImpl may call
++  // RemoveInkDropLayer on partly destructed InkDropHost. In
++  // that case |ink_drop_mask_| must be still valid.
++  std::unique_ptr<views::InkDropMask> ink_drop_mask_;
++
+   // Should not be accessed directly. Use GetInkDrop() instead.
+   std::unique_ptr<InkDrop> ink_drop_;
+ 
+@@ -249,8 +254,6 @@ class VIEWS_EXPORT InkDropHost {
+   int ink_drop_small_corner_radius_ = 2;
+   int ink_drop_large_corner_radius_ = 4;
+ 
+-  std::unique_ptr<views::InkDropMask> ink_drop_mask_;
+-
+   base::RepeatingCallback<std::unique_ptr<InkDrop>()> create_ink_drop_callback_;
+   base::RepeatingCallback<std::unique_ptr<InkDropRipple>()>
+       create_ink_drop_ripple_callback_;
diff --git a/chromium.spec b/chromium.spec
index 42404cac..149273ef 100644
--- a/chromium.spec
+++ b/chromium.spec
@@ -222,7 +222,7 @@ Name:		chromium%{chromium_channel}%{nsuffix}
 %else
 Name:		chromium%{chromium_channel}
 %endif
-Version:	%{majorversion}.0.4606.61
+Version:	%{majorversion}.0.4606.71
 Release:	1%{?dist}
 %if %{?freeworld}
 %if %{?shared}
@@ -334,6 +334,8 @@ Patch95:	chromium-93.0.4577.63-mojo-header-fix.patch
 Patch96:	chromium-94.0.4606.54-webrtc-BUILD.gn-fix-multiple-defines.patch
 # Fix extra qualification error
 Patch97:	chromium-94.0.4606.61-remoting-extra-qualification.patch
+# From gentoo
+Patch98:	chromium-94.0.4606.71-InkDropHost-crash.patch
 
 
 # Use lstdc++ on EPEL7 only
@@ -1010,6 +1012,7 @@ udev.
 %patch95 -p1 -b .mojo-header-fix
 %patch96 -p1 -b .webrtc-BUILD.gn-fix-multiple-defines
 %patch97 -p1 -b .remoting-extra-qualification
+%patch98 -p1 -b .InkDropHost-crash
 
 # Fedora branded user agent
 %if 0%{?fedora}
@@ -2095,6 +2098,9 @@ getent group chrome-remote-desktop >/dev/null || groupadd -r chrome-remote-deskt
 
 
 %changelog
+* Tue Oct  5 2021 Tom Callaway <spot@fedoraproject.org> - 94.0.4606.71-1
+- update to 94.0.4606.71
+
 * Fri Sep 24 2021 Tom Callaway <spot@fedoraproject.org> - 94.0.4606.61-1
 - update to 94.0.4606.61
 
diff --git a/sources b/sources
index e1d64f9f..b0e0c937 100644
--- a/sources
+++ b/sources
@@ -21,4 +21,4 @@ SHA512 (NotoSansSymbols2-Regular.ttf) = 2644b42c3fdccfe12395f9b61553aced169a0f1d
 SHA512 (NotoSansTibetan-Regular.ttf) = fb5a48fcaea80eebe7d692f6fcf00d59d47658a358d0ec8e046fc559873f88bd595b2da474d2826abd9e9305f3741c69058d867b1e6048f37fe7d71b5d3af36a
 SHA512 (node-v12.22.6-linux-arm64.tar.xz) = 87ce5eb954deb1d0debe6fa02b28a3cc675e12fca1e51d44b123ab294aa39ce0c6b8ac9eae1e7a6e32673ea2c2d480651d9ba7eea73012f0529503eebe9eb34d
 SHA512 (node-v12.22.6-linux-x64.tar.xz) = e1b55c32343cb2ccc40d888c705414bebf9c46b02083d13731df79b1e79521b7277761f6bcca041e40e3a2e47c67bb8e7848aa2b919a9de5c2ebf62c4a9c7176
-SHA512 (chromium-94.0.4606.61-clean.tar.xz) = 376d619e4bc4d5a5641aaf22d855889465c9b8990dcbc83517548edc9ada2e7087b66e839090c82cbbe2d46c2e98dc7f4b6461390a1f0d1d298cc698d1736b5e
+SHA512 (chromium-94.0.4606.71-clean.tar.xz) = efed6617109901bee04145772e34260a9c45bc72cc4274cac32db1330f22f3867bc934edf75d2f144e43e52bce052d1f1e0300c046d6d7d823c2a0341a9c6469