diff --git a/chromium-91-1190561-boo1186948.patch b/chromium-91-1190561-boo1186948.patch
new file mode 100644
index 00000000..b9fd1f72
--- /dev/null
+++ b/chromium-91-1190561-boo1186948.patch
@@ -0,0 +1,45 @@
+From c2d0133f47afb59b4ce64e42215d1d053f15250a Mon Sep 17 00:00:00 2001
+From: Stephan Hartmann <stha09@googlemail.com>
+Date: Tue, 13 Apr 2021 23:21:42 +0000
+Subject: [PATCH] fix crash in ThemeService
+
+ThemeSyncableService and ThemeService are owned by each other. On
+destruction of ThemeService, ThemeSyncableService gets destructed as
+well, but calls RemoveObserver of partly destructed ThemeService object.
+To avoid already destructed |observers_| list, move it before
+|theme_syncable_service_| definition.
+
+Bug: 1190561
+Change-Id: I4dc2c990d589071d97b7fa737afef54463c84751
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2821311
+Commit-Queue: Peter Kasting <pkasting@chromium.org>
+Reviewed-by: Peter Kasting <pkasting@chromium.org>
+Cr-Commit-Position: refs/heads/master@{#872164}
+---
+ chrome/browser/themes/theme_service.h | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/chrome/browser/themes/theme_service.h b/chrome/browser/themes/theme_service.h
+index 592d40ae9de0f..337dfac9a040f 100644
+--- a/chrome/browser/themes/theme_service.h
++++ b/chrome/browser/themes/theme_service.h
+@@ -299,6 +299,10 @@ class ThemeService : public KeyedService,
+   // The number of infobars currently displayed.
+   int number_of_reinstallers_ = 0;
+ 
++  // Declared before |theme_syncable_service_|, because ThemeSyncableService
++  // removes itself from the |observers_| list on destruction.
++  base::ObserverList<ThemeServiceObserver> observers_;
++
+   std::unique_ptr<ThemeSyncableService> theme_syncable_service_;
+ 
+ #if BUILDFLAG(ENABLE_EXTENSIONS)
+@@ -320,8 +324,6 @@ class ThemeService : public KeyedService,
+   ScopedObserver<ui::NativeTheme, ui::NativeThemeObserver>
+       native_theme_observer_{this};
+ 
+-  base::ObserverList<ThemeServiceObserver> observers_;
+-
+   base::WeakPtrFactory<ThemeService> weak_ptr_factory_{this};
+ 
+   DISALLOW_COPY_AND_ASSIGN(ThemeService);
diff --git a/chromium.spec b/chromium.spec
index 4d818881..4b6a0fb1 100644
--- a/chromium.spec
+++ b/chromium.spec
@@ -216,7 +216,7 @@ Name:		chromium%{chromium_channel}%{nsuffix}
 Name:		chromium%{chromium_channel}
 %endif
 Version:	%{majorversion}.0.4472.114
-Release:	1%{?dist}
+Release:	2%{?dist}
 %if %{?freeworld}
 %if %{?shared}
 # chromium-libs-media-freeworld
@@ -309,6 +309,8 @@ Patch79:	chromium-90.0.4430.72-widevine-no-download.patch
 # Fix crashes with components/cast_*
 # Thanks to Gentoo
 Patch80:	https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/files/chromium-89-EnumTable-crash.patch
+# Fix crashes with ThemeService, thanks OpenSUSE
+Patch81:	chromium-91-1190561-boo1186948.patch
 
 
 # Use lstdc++ on EPEL7 only
@@ -943,6 +945,7 @@ udev.
 %patch77 -p1 -b .gcc-swiftshader-visibility
 %patch79 -p1 -b .widevine-no-download
 %patch80 -p1 -b .EnumTable-crash
+%patch81 -p1 -b .ThemeService-crash
 
 # Fedora branded user agent
 %if 0%{?fedora}
@@ -2007,6 +2010,9 @@ getent group chrome-remote-desktop >/dev/null || groupadd -r chrome-remote-deskt
 
 
 %changelog
+* Tue Jul  6 2021 Tom Callaway <spot@fedoraproject.org> - 91.0.4472.114-2
+- fix ThemeService crash (thanks OpenSUSE)
+
 * Wed Jun 23 2021 Tom Callaway <spot@fedoraproject.org> - 91.0.4472.114-1
 - update to 91.0.4472.114