diff --git a/chrome/renderer/chrome_render_frame_observer.cc b/chrome/renderer/chrome_render_frame_observer.cc
index 18857fd6eea03a..eb91d0a70b7f5e 100644
--- a/chrome/renderer/chrome_render_frame_observer.cc
+++ b/chrome/renderer/chrome_render_frame_observer.cc
@@ -122,10 +122,10 @@ ChromeRenderFrameObserver::ChromeRenderFrameObserver(
     : content::RenderFrameObserver(render_frame),
       translate_helper_(nullptr),
       phishing_classifier_(nullptr) {
-  render_frame->GetInterfaceRegistry()->AddInterface(
+  registry_.AddInterface(
       base::Bind(&ChromeRenderFrameObserver::OnImageContextMenuRendererRequest,
                  base::Unretained(this)));
-  render_frame->GetInterfaceRegistry()->AddInterface(
+  registry_.AddInterface(
       base::Bind(&ChromeRenderFrameObserver::OnThumbnailCapturerRequest,
                  base::Unretained(this)));
 
@@ -145,6 +145,12 @@ ChromeRenderFrameObserver::ChromeRenderFrameObserver(
 ChromeRenderFrameObserver::~ChromeRenderFrameObserver() {
 }
 
+void ChromeRenderFrameObserver::OnInterfaceRequestForFrame(
+    const std::string& interface_name,
+    mojo::ScopedMessagePipeHandle* interface_pipe) {
+  registry_.TryBindInterface(interface_name, interface_pipe);
+}
+
 bool ChromeRenderFrameObserver::OnMessageReceived(const IPC::Message& message) {
   // Filter only.
   bool handled = true;
diff --git a/chrome/renderer/chrome_render_frame_observer.h b/chrome/renderer/chrome_render_frame_observer.h
index 542fc20bc8df54..f24f678ef2468d 100644
--- a/chrome/renderer/chrome_render_frame_observer.h
+++ b/chrome/renderer/chrome_render_frame_observer.h
@@ -12,6 +12,7 @@
 #include "chrome/common/thumbnail_capturer.mojom.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
 
 namespace gfx {
 class Size;
@@ -39,6 +40,9 @@ class ChromeRenderFrameObserver
   enum TextCaptureType { PRELIMINARY_CAPTURE, FINAL_CAPTURE };
 
   // RenderFrameObserver implementation.
+  void OnInterfaceRequestForFrame(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle* interface_pipe) override;
   bool OnMessageReceived(const IPC::Message& message) override;
   void DidStartProvisionalLoad(blink::WebDataSource* data_source) override;
   void DidFinishLoad() override;
@@ -93,6 +97,8 @@ class ChromeRenderFrameObserver
   mojo::BindingSet<chrome::mojom::ThumbnailCapturer>
       thumbnail_capturer_bindings_;
 
+  service_manager::BinderRegistry registry_;
+
   DISALLOW_COPY_AND_ASSIGN(ChromeRenderFrameObserver);
 };
 
diff --git a/chrome/renderer/content_settings_observer.cc b/chrome/renderer/content_settings_observer.cc
index 1a01c6b708c79e..b51c4870f18126 100644
--- a/chrome/renderer/content_settings_observer.cc
+++ b/chrome/renderer/content_settings_observer.cc
@@ -106,7 +106,7 @@ ContentSettingsObserver::ContentSettingsObserver(
   ClearBlockedContentSettings();
   render_frame->GetWebFrame()->SetContentSettingsClient(this);
 
-  render_frame->GetInterfaceRegistry()->AddInterface(
+  registry_.AddInterface(
       base::Bind(&ContentSettingsObserver::OnInsecureContentRendererRequest,
                  base::Unretained(this)));
 
@@ -160,6 +160,12 @@ void ContentSettingsObserver::DidBlockContentType(
   }
 }
 
+void ContentSettingsObserver::OnInterfaceRequestForFrame(
+    const std::string& interface_name,
+    mojo::ScopedMessagePipeHandle* interface_pipe) {
+  registry_.TryBindInterface(interface_name, interface_pipe);
+}
+
 bool ContentSettingsObserver::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(ContentSettingsObserver, message)
diff --git a/chrome/renderer/content_settings_observer.h b/chrome/renderer/content_settings_observer.h
index 3874e19666c78d..21528ef5ea9b14 100644
--- a/chrome/renderer/content_settings_observer.h
+++ b/chrome/renderer/content_settings_observer.h
@@ -19,6 +19,7 @@
 #include "content/public/renderer/render_frame_observer_tracker.h"
 #include "extensions/features/features.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
 #include "third_party/WebKit/public/platform/WebContentSettingsClient.h"
 #include "url/gurl.h"
 
@@ -95,6 +96,9 @@ class ContentSettingsObserver
   FRIEND_TEST_ALL_PREFIXES(ChromeRenderViewTest, PluginsTemporarilyAllowed);
 
   // RenderFrameObserver implementation.
+  void OnInterfaceRequestForFrame(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle* interface_pipe) override;
   bool OnMessageReceived(const IPC::Message& message) override;
   void DidCommitProvisionalLoad(bool is_new_navigation,
                                 bool is_same_document_navigation) override;
@@ -170,6 +174,8 @@ class ContentSettingsObserver
   mojo::BindingSet<chrome::mojom::InsecureContentRenderer>
       insecure_content_renderer_bindings_;
 
+  service_manager::BinderRegistry registry_;
+
   DISALLOW_COPY_AND_ASSIGN(ContentSettingsObserver);
 };
 
diff --git a/components/autofill/content/renderer/autofill_agent.cc b/components/autofill/content/renderer/autofill_agent.cc
index 2b673cbad61f54..b050c71b6fc627 100644
--- a/components/autofill/content/renderer/autofill_agent.cc
+++ b/components/autofill/content/renderer/autofill_agent.cc
@@ -161,8 +161,7 @@ AutofillAgent::AutofillAgent(content::RenderFrame* render_frame,
   render_frame->GetWebFrame()->SetAutofillClient(this);
   password_autofill_agent->SetAutofillAgent(this);
 
-  // AutofillAgent is guaranteed to outlive |render_frame|.
-  render_frame->GetInterfaceRegistry()->AddInterface(
+  registry_.AddInterface(
       base::Bind(&AutofillAgent::BindRequest, base::Unretained(this)));
 }
 
@@ -178,6 +177,12 @@ bool AutofillAgent::FormDataCompare::operator()(const FormData& lhs,
          std::tie(rhs.name, rhs.origin, rhs.action, rhs.is_form_tag);
 }
 
+void AutofillAgent::OnInterfaceRequestForFrame(
+    const std::string& interface_name,
+    mojo::ScopedMessagePipeHandle* interface_pipe) {
+  registry_.TryBindInterface(interface_name, interface_pipe);
+}
+
 void AutofillAgent::DidCommitProvisionalLoad(bool is_new_navigation,
                                              bool is_same_document_navigation) {
   blink::WebFrame* frame = render_frame()->GetWebFrame();
diff --git a/components/autofill/content/renderer/autofill_agent.h b/components/autofill/content/renderer/autofill_agent.h
index 549ec8facf88fd..1c41b1f02a84ba 100644
--- a/components/autofill/content/renderer/autofill_agent.h
+++ b/components/autofill/content/renderer/autofill_agent.h
@@ -20,6 +20,7 @@
 #include "components/autofill/content/renderer/page_click_tracker.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
 #include "third_party/WebKit/public/web/WebAutofillClient.h"
 #include "third_party/WebKit/public/web/WebFormControlElement.h"
 #include "third_party/WebKit/public/web/WebFormElement.h"
@@ -131,6 +132,9 @@ class AutofillAgent : public content::RenderFrameObserver,
   };
 
   // content::RenderFrameObserver:
+  void OnInterfaceRequestForFrame(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle* interface_pipe) override;
   void DidCommitProvisionalLoad(bool is_new_navigation,
                                 bool is_same_document_navigation) override;
   void DidFinishDocumentLoad() override;
@@ -292,6 +296,8 @@ class AutofillAgent : public content::RenderFrameObserver,
 
   mojom::AutofillDriverPtr autofill_driver_;
 
+  service_manager::BinderRegistry registry_;
+
   base::WeakPtrFactory<AutofillAgent> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(AutofillAgent);
diff --git a/components/autofill/content/renderer/password_autofill_agent.cc b/components/autofill/content/renderer/password_autofill_agent.cc
index 88a79968f86a28..82b0a14b25a475 100644
--- a/components/autofill/content/renderer/password_autofill_agent.cc
+++ b/components/autofill/content/renderer/password_autofill_agent.cc
@@ -687,8 +687,7 @@ PasswordAutofillAgent::PasswordAutofillAgent(content::RenderFrame* render_frame)
       checked_safe_browsing_reputation_(false),
       binding_(this),
       form_element_observer_(nullptr) {
-  // PasswordAutofillAgent is guaranteed to outlive |render_frame|.
-  render_frame->GetInterfaceRegistry()->AddInterface(
+  registry_.AddInterface(
       base::Bind(&PasswordAutofillAgent::BindRequest, base::Unretained(this)));
 }
 
@@ -1282,6 +1281,12 @@ void PasswordAutofillAgent::SendPasswordForms(bool only_visible) {
   }
 }
 
+void PasswordAutofillAgent::OnInterfaceRequestForFrame(
+    const std::string& interface_name,
+    mojo::ScopedMessagePipeHandle* interface_pipe) {
+  registry_.TryBindInterface(interface_name, interface_pipe);
+}
+
 void PasswordAutofillAgent::DidFinishDocumentLoad() {
   // The |frame| contents have been parsed, but not yet rendered.  Let the
   // PasswordManager know that forms are loaded, even though we can't yet tell
diff --git a/components/autofill/content/renderer/password_autofill_agent.h b/components/autofill/content/renderer/password_autofill_agent.h
index a39e3d854fc255..3b8884cabe9257 100644
--- a/components/autofill/content/renderer/password_autofill_agent.h
+++ b/components/autofill/content/renderer/password_autofill_agent.h
@@ -22,6 +22,7 @@
 #include "content/public/renderer/render_frame_observer.h"
 #include "content/public/renderer/render_view_observer.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
 #include "third_party/WebKit/public/web/WebInputElement.h"
 
 namespace blink {
@@ -201,6 +202,9 @@ class PasswordAutofillAgent : public content::RenderFrameObserver,
   };
 
   // RenderFrameObserver:
+  void OnInterfaceRequestForFrame(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle* interface_pipe) override;
   void DidFinishDocumentLoad() override;
   void DidFinishLoad() override;
   void FrameDetached() override;
@@ -312,6 +316,8 @@ class PasswordAutofillAgent : public content::RenderFrameObserver,
 
   blink::WebFormElementObserver* form_element_observer_;
 
+  service_manager::BinderRegistry registry_;
+
   DISALLOW_COPY_AND_ASSIGN(PasswordAutofillAgent);
 };
 
diff --git a/components/autofill/content/renderer/password_generation_agent.cc b/components/autofill/content/renderer/password_generation_agent.cc
index 210d4f514f75f2..f73ab3911ac28e 100644
--- a/components/autofill/content/renderer/password_generation_agent.cc
+++ b/components/autofill/content/renderer/password_generation_agent.cc
@@ -167,9 +167,8 @@ PasswordGenerationAgent::PasswordGenerationAgent(
       password_agent_(password_agent),
       binding_(this) {
   LogBoolean(Logger::STRING_GENERATION_RENDERER_ENABLED, enabled_);
-  // PasswordGenerationAgent is guaranteed to outlive |render_frame|.
-  render_frame->GetInterfaceRegistry()->AddInterface(base::Bind(
-      &PasswordGenerationAgent::BindRequest, base::Unretained(this)));
+  registry_.AddInterface(base::Bind(&PasswordGenerationAgent::BindRequest,
+                                    base::Unretained(this)));
 }
 PasswordGenerationAgent::~PasswordGenerationAgent() {}
 
@@ -178,6 +177,12 @@ void PasswordGenerationAgent::BindRequest(
   binding_.Bind(std::move(request));
 }
 
+void PasswordGenerationAgent::OnInterfaceRequestForFrame(
+    const std::string& interface_name,
+    mojo::ScopedMessagePipeHandle* interface_pipe) {
+  registry_.TryBindInterface(interface_name, interface_pipe);
+}
+
 void PasswordGenerationAgent::DidFinishDocumentLoad() {
   // Update stats for main frame navigation.
   if (!render_frame()->GetWebFrame()->Parent()) {
diff --git a/components/autofill/content/renderer/password_generation_agent.h b/components/autofill/content/renderer/password_generation_agent.h
index 2af62823a7641f..f8ab6a0c21e113 100644
--- a/components/autofill/content/renderer/password_generation_agent.h
+++ b/components/autofill/content/renderer/password_generation_agent.h
@@ -19,6 +19,7 @@
 #include "components/autofill/content/renderer/renderer_save_password_progress_logger.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
 #include "third_party/WebKit/public/web/WebInputElement.h"
 #include "url/gurl.h"
 
@@ -87,6 +88,9 @@ class PasswordGenerationAgent : public content::RenderFrameObserver,
   typedef std::vector<AccountCreationFormData> AccountCreationFormDataList;
 
   // RenderFrameObserver:
+  void OnInterfaceRequestForFrame(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle* interface_pipe) override;
   void DidFinishDocumentLoad() override;
   void DidFinishLoad() override;
   void OnDestruct() override;
@@ -193,6 +197,8 @@ class PasswordGenerationAgent : public content::RenderFrameObserver,
 
   mojo::Binding<mojom::PasswordGenerationAgent> binding_;
 
+  service_manager::BinderRegistry registry_;
+
   DISALLOW_COPY_AND_ASSIGN(PasswordGenerationAgent);
 };
 
diff --git a/components/contextual_search/renderer/overlay_js_render_frame_observer.cc b/components/contextual_search/renderer/overlay_js_render_frame_observer.cc
index c2cd286f5617ba..9dd13a68581fe6 100644
--- a/components/contextual_search/renderer/overlay_js_render_frame_observer.cc
+++ b/components/contextual_search/renderer/overlay_js_render_frame_observer.cc
@@ -25,13 +25,19 @@ OverlayJsRenderFrameObserver::OverlayJsRenderFrameObserver(
 
 OverlayJsRenderFrameObserver::~OverlayJsRenderFrameObserver() {}
 
+void OverlayJsRenderFrameObserver::OnInterfaceRequestForFrame(
+    const std::string& interface_name,
+    mojo::ScopedMessagePipeHandle* interface_pipe) {
+  registry_.TryBindInterface(interface_name, interface_pipe);
+}
+
 void OverlayJsRenderFrameObserver::DidStartProvisionalLoad(
     blink::WebDataSource* data_source) {
   RegisterMojoInterface();
 }
 
 void OverlayJsRenderFrameObserver::RegisterMojoInterface() {
-  render_frame()->GetInterfaceRegistry()->AddInterface(base::Bind(
+  registry_.AddInterface(base::Bind(
       &OverlayJsRenderFrameObserver::CreateOverlayPageNotifierService,
       weak_factory_.GetWeakPtr()));
 }
@@ -62,11 +68,7 @@ void OverlayJsRenderFrameObserver::DidFinishLoad() {
 }
 
 void OverlayJsRenderFrameObserver::DestroyOverlayPageNotifierService() {
-  if (render_frame()) {
-    render_frame()
-        ->GetInterfaceRegistry()
-        ->RemoveInterface<mojom::OverlayPageNotifierService>();
-  }
+  registry_.RemoveInterface<mojom::OverlayPageNotifierService>();
 }
 
 void OverlayJsRenderFrameObserver::OnDestruct() {
diff --git a/components/contextual_search/renderer/overlay_js_render_frame_observer.h b/components/contextual_search/renderer/overlay_js_render_frame_observer.h
index 2bdc547406df40..709cacd4a8297f 100644
--- a/components/contextual_search/renderer/overlay_js_render_frame_observer.h
+++ b/components/contextual_search/renderer/overlay_js_render_frame_observer.h
@@ -10,6 +10,7 @@
 #include "components/contextual_search/common/overlay_page_notifier_service.mojom.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_frame_observer.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "v8/include/v8.h"
 
@@ -25,6 +26,9 @@ class OverlayJsRenderFrameObserver : public content::RenderFrameObserver {
   ~OverlayJsRenderFrameObserver() override;
 
   // RenderFrameObserver implementation.
+  void OnInterfaceRequestForFrame(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle* interface_pipe) override;
   void DidStartProvisionalLoad(blink::WebDataSource* data_source) override;
   void DidClearWindowObject() override;
   void DidFinishLoad() override;
@@ -49,6 +53,8 @@ class OverlayJsRenderFrameObserver : public content::RenderFrameObserver {
   // Track if the current page is presented in the contextual search overlay.
   bool is_contextual_search_overlay_;
 
+  service_manager::BinderRegistry registry_;
+
   base::WeakPtrFactory<OverlayJsRenderFrameObserver> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(OverlayJsRenderFrameObserver);
diff --git a/components/dom_distiller/content/renderer/distiller_js_render_frame_observer.cc b/components/dom_distiller/content/renderer/distiller_js_render_frame_observer.cc
index 5be613204b998b..27b13a835882ab 100644
--- a/components/dom_distiller/content/renderer/distiller_js_render_frame_observer.cc
+++ b/components/dom_distiller/content/renderer/distiller_js_render_frame_observer.cc
@@ -27,6 +27,12 @@ DistillerJsRenderFrameObserver::DistillerJsRenderFrameObserver(
 
 DistillerJsRenderFrameObserver::~DistillerJsRenderFrameObserver() {}
 
+void DistillerJsRenderFrameObserver::OnInterfaceRequestForFrame(
+    const std::string& interface_name,
+    mojo::ScopedMessagePipeHandle* interface_pipe) {
+  registry_.TryBindInterface(interface_name, interface_pipe);
+}
+
 void DistillerJsRenderFrameObserver::DidStartProvisionalLoad(
     blink::WebDataSource* data_source) {
   RegisterMojoInterface();
@@ -36,9 +42,7 @@ void DistillerJsRenderFrameObserver::DidFinishLoad() {
   // If no message about the distilled page was received at this point, there
   // will not be one; remove the mojom::DistillerPageNotifierService from the
   // registry.
-  render_frame()
-      ->GetInterfaceRegistry()
-      ->RemoveInterface<mojom::DistillerPageNotifierService>();
+  registry_.RemoveInterface<mojom::DistillerPageNotifierService>();
 }
 
 void DistillerJsRenderFrameObserver::DidCreateScriptContext(
@@ -54,7 +58,7 @@ void DistillerJsRenderFrameObserver::DidCreateScriptContext(
 }
 
 void DistillerJsRenderFrameObserver::RegisterMojoInterface() {
-  render_frame()->GetInterfaceRegistry()->AddInterface(base::Bind(
+  registry_.AddInterface(base::Bind(
       &DistillerJsRenderFrameObserver::CreateDistillerPageNotifierService,
       weak_factory_.GetWeakPtr()));
 }
diff --git a/components/dom_distiller/content/renderer/distiller_js_render_frame_observer.h b/components/dom_distiller/content/renderer/distiller_js_render_frame_observer.h
index c57c3c4a0d03f5..aed21387cb035a 100644
--- a/components/dom_distiller/content/renderer/distiller_js_render_frame_observer.h
+++ b/components/dom_distiller/content/renderer/distiller_js_render_frame_observer.h
@@ -11,6 +11,7 @@
 #include "components/dom_distiller/content/renderer/distiller_page_notifier_service_impl.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_frame_observer.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "v8/include/v8.h"
 
@@ -27,6 +28,9 @@ class DistillerJsRenderFrameObserver : public content::RenderFrameObserver {
   ~DistillerJsRenderFrameObserver() override;
 
   // RenderFrameObserver implementation.
+  void OnInterfaceRequestForFrame(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle* interface_pipe) override;
   void DidStartProvisionalLoad(blink::WebDataSource* data_source) override;
   void DidFinishLoad() override;
   void DidCreateScriptContext(v8::Local<v8::Context> context,
@@ -51,6 +55,8 @@ class DistillerJsRenderFrameObserver : public content::RenderFrameObserver {
   // Track if the current page is distilled. This is needed for testing.
   bool is_distiller_page_;
 
+  service_manager::BinderRegistry registry_;
+
   // Handle to "distiller" JavaScript object functionality.
   std::unique_ptr<DistillerNativeJavaScript> native_javascript_handle_;
   base::WeakPtrFactory<DistillerJsRenderFrameObserver> weak_factory_;
diff --git a/components/spellcheck/renderer/spellcheck_panel.cc b/components/spellcheck/renderer/spellcheck_panel.cc
index 545f1cf52b8540..f045f90f37f22c 100644
--- a/components/spellcheck/renderer/spellcheck_panel.cc
+++ b/components/spellcheck/renderer/spellcheck_panel.cc
@@ -29,13 +29,19 @@ SpellCheckPanel::SpellCheckPanel(content::RenderFrame* render_frame)
     : content::RenderFrameObserver(render_frame),
       spelling_panel_visible_(false) {
   DCHECK(render_frame);
-  render_frame->GetInterfaceRegistry()->AddInterface(base::Bind(
-      &SpellCheckPanel::SpellCheckPanelRequest, base::Unretained(this)));
+  registry_.AddInterface(base::Bind(&SpellCheckPanel::SpellCheckPanelRequest,
+                                    base::Unretained(this)));
   render_frame->GetWebFrame()->SetSpellCheckPanelHostClient(this);
 }
 
 SpellCheckPanel::~SpellCheckPanel() = default;
 
+void SpellCheckPanel::OnInterfaceRequestForFrame(
+    const std::string& interface_name,
+    mojo::ScopedMessagePipeHandle* interface_pipe) {
+  registry_.TryBindInterface(interface_name, interface_pipe);
+}
+
 void SpellCheckPanel::OnDestruct() {
   delete this;
 }
diff --git a/components/spellcheck/renderer/spellcheck_panel.h b/components/spellcheck/renderer/spellcheck_panel.h
index 8b3f63f41fbb34..5f1d6464513efb 100644
--- a/components/spellcheck/renderer/spellcheck_panel.h
+++ b/components/spellcheck/renderer/spellcheck_panel.h
@@ -10,6 +10,7 @@
 #include "components/spellcheck/spellcheck_build_features.h"
 #include "content/public/renderer/render_frame_observer.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
 #include "third_party/WebKit/public/platform/WebSpellCheckPanelHostClient.h"
 
 #if !BUILDFLAG(HAS_SPELLCHECK_PANEL)
@@ -25,6 +26,9 @@ class SpellCheckPanel : public content::RenderFrameObserver,
 
  private:
   // content::RenderFrameObserver:
+  void OnInterfaceRequestForFrame(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle* interface_pipe) override;
   void OnDestruct() override;
 
   // blink::WebSpellCheckPanelHostClient:
@@ -47,6 +51,8 @@ class SpellCheckPanel : public content::RenderFrameObserver,
   // True if the browser is showing the spelling panel.
   bool spelling_panel_visible_;
 
+  service_manager::BinderRegistry registry_;
+
   DISALLOW_COPY_AND_ASSIGN(SpellCheckPanel);
 };
 
diff --git a/content/public/renderer/render_frame.h b/content/public/renderer/render_frame.h
index 9a390eb76f2cbf..a1b8056ce25c24 100644
--- a/content/public/renderer/render_frame.h
+++ b/content/public/renderer/render_frame.h
@@ -163,9 +163,11 @@ class CONTENT_EXPORT RenderFrame : public IPC::Listener,
   // Return true if this frame is hidden.
   virtual bool IsHidden() = 0;
 
-  // Returns the BinderRegistry that this process uses to expose interfaces
-  // to the application running in this frame.
-  virtual service_manager::BinderRegistry* GetInterfaceRegistry() = 0;
+  // Ask the RenderFrame (or its observers) to bind a request for
+  // |interface_name| to |interface_pipe|.
+  virtual void BindLocalInterface(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle interface_pipe) = 0;
 
   // Returns the InterfaceProvider that this process can use to bind
   // interfaces exposed to it by the application running in this frame.
diff --git a/content/public/renderer/render_frame_observer.h b/content/public/renderer/render_frame_observer.h
index 48b932e878e3a1..02f6a5573466f2 100644
--- a/content/public/renderer/render_frame_observer.h
+++ b/content/public/renderer/render_frame_observer.h
@@ -13,6 +13,7 @@
 #include "content/common/content_export.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
+#include "mojo/public/cpp/system/message_pipe.h"
 #include "third_party/WebKit/public/platform/WebLoadingBehaviorFlag.h"
 #include "third_party/WebKit/public/platform/WebVector.h"
 #include "third_party/WebKit/public/web/WebMeaningfulLayout.h"
@@ -131,6 +132,12 @@ class CONTENT_EXPORT RenderFrameObserver : public IPC::Listener,
   // Called when a worker fetch context will be created.
   virtual void WillCreateWorkerFetchContext(blink::WebWorkerFetchContext*) {}
 
+  // Called to give the embedder an opportunity to bind an interface request
+  // for a frame. If the request can be bound, |interface_pipe| will be taken.
+  virtual void OnInterfaceRequestForFrame(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle* interface_pipe) {}
+
   // IPC::Listener implementation.
   bool OnMessageReceived(const IPC::Message& message) override;
 
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index e4e8d54eaadc74..e222f3f5a86c4c 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -1201,13 +1201,12 @@ RenderFrameImpl::RenderFrameImpl(const CreateParams& params)
                      base::Bind(&RenderFrameImpl::RequestOverlayRoutingToken,
                                 base::Unretained(this))),
       weak_factory_(this) {
-  interface_registry_ = base::MakeUnique<service_manager::BinderRegistry>();
   service_manager::mojom::InterfaceProviderPtr remote_interfaces;
   pending_remote_interface_provider_request_ = MakeRequest(&remote_interfaces);
   remote_interfaces_.reset(new service_manager::InterfaceProvider);
   remote_interfaces_->Bind(std::move(remote_interfaces));
   blink_interface_registry_.reset(
-      new BlinkInterfaceRegistryImpl(interface_registry_->GetWeakPtr()));
+      new BlinkInterfaceRegistryImpl(registry_.GetWeakPtr()));
 
   // Must call after binding our own remote interfaces.
   media_factory_.SetupMojo();
@@ -1353,8 +1352,14 @@ void RenderFrameImpl::InitializeBlameContext(RenderFrameImpl* parent_frame) {
 void RenderFrameImpl::GetInterface(
     const std::string& interface_name,
     mojo::ScopedMessagePipeHandle interface_pipe) {
-  // TODO(beng): We should be getting this info from the frame factory request.
-  interface_registry_->BindInterface(interface_name, std::move(interface_pipe));
+  if (registry_.TryBindInterface(interface_name, &interface_pipe))
+    return;
+
+  for (auto& observer : observers_) {
+    observer.OnInterfaceRequestForFrame(interface_name, &interface_pipe);
+    if (!interface_pipe.is_valid())
+      return;
+  }
 }
 
 RenderWidget* RenderFrameImpl::GetRenderWidget() {
@@ -2652,8 +2657,10 @@ void RenderFrameImpl::ExecuteJavaScript(const base::string16& javascript) {
   OnJavaScriptExecuteRequest(javascript, 0, false);
 }
 
-service_manager::BinderRegistry* RenderFrameImpl::GetInterfaceRegistry() {
-  return interface_registry_.get();
+void RenderFrameImpl::BindLocalInterface(
+    const std::string& interface_name,
+    mojo::ScopedMessagePipeHandle interface_pipe) {
+  GetInterface(interface_name, std::move(interface_pipe));
 }
 
 service_manager::InterfaceProvider* RenderFrameImpl::GetRemoteInterfaces() {
@@ -6289,7 +6296,7 @@ void RenderFrameImpl::InitializeUserMediaClient() {
       this, RenderThreadImpl::current()->GetPeerConnectionDependencyFactory(),
       base::MakeUnique<MediaStreamDispatcher>(this),
       render_thread->GetWorkerTaskRunner());
-  GetInterfaceRegistry()->AddInterface(
+  registry_.AddInterface(
       base::Bind(&MediaDevicesListenerImpl::Create, GetRoutingID()));
 #endif
 }
@@ -6682,13 +6689,13 @@ void RenderFrameImpl::RegisterMojoInterfaces() {
   GetAssociatedInterfaceRegistry()->AddInterface(base::Bind(
       &RenderFrameImpl::BindFrameBindingsControl, weak_factory_.GetWeakPtr()));
 
-  GetInterfaceRegistry()->AddInterface(base::Bind(
-      &FrameInputHandlerImpl::CreateMojoService, weak_factory_.GetWeakPtr()));
+  registry_.AddInterface(base::Bind(&FrameInputHandlerImpl::CreateMojoService,
+                                    weak_factory_.GetWeakPtr()));
 
   if (!frame_->Parent()) {
     // Only main frame have ImageDownloader service.
-    GetInterfaceRegistry()->AddInterface(base::Bind(
-        &ImageDownloaderImpl::CreateMojoService, base::Unretained(this)));
+    registry_.AddInterface(base::Bind(&ImageDownloaderImpl::CreateMojoService,
+                                      base::Unretained(this)));
 
     // Host zoom is per-page, so only added on the main frame.
     GetAssociatedInterfaceRegistry()->AddInterface(base::Bind(
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index 9fcf3bbd3d381a..11c451a8e04b6f 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -432,7 +432,9 @@ class CONTENT_EXPORT RenderFrameImpl
   void ExecuteJavaScript(const base::string16& javascript) override;
   bool IsMainFrame() override;
   bool IsHidden() override;
-  service_manager::BinderRegistry* GetInterfaceRegistry() override;
+  void BindLocalInterface(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle interface_pipe) override;
   service_manager::InterfaceProvider* GetRemoteInterfaces() override;
   AssociatedInterfaceRegistry* GetAssociatedInterfaceRegistry() override;
   AssociatedInterfaceProvider* GetRemoteAssociatedInterfaces() override;
@@ -1309,7 +1311,7 @@ class CONTENT_EXPORT RenderFrameImpl
   // The PushMessagingClient attached to this frame, lazily initialized.
   PushMessagingClient* push_messaging_client_;
 
-  std::unique_ptr<service_manager::BinderRegistry> interface_registry_;
+  service_manager::BinderRegistry registry_;
   std::unique_ptr<service_manager::InterfaceProvider> remote_interfaces_;
   std::unique_ptr<BlinkInterfaceRegistryImpl> blink_interface_registry_;
   service_manager::mojom::InterfaceProviderRequest
diff --git a/content/shell/renderer/layout_test/blink_test_runner.cc b/content/shell/renderer/layout_test/blink_test_runner.cc
index 5b2a0d7e855d68..9c95ab271a6ecf 100644
--- a/content/shell/renderer/layout_test/blink_test_runner.cc
+++ b/content/shell/renderer/layout_test/blink_test_runner.cc
@@ -700,13 +700,10 @@ void BlinkTestRunner::DispatchBeforeInstallPromptEvent(
     const std::vector<std::string>& event_platforms,
     const base::Callback<void(bool)>& callback) {
   app_banner_service_.reset(new test_runner::AppBannerService());
-
-  service_manager::BinderRegistry* registry =
-      render_view()->GetMainRenderFrame()->GetInterfaceRegistry();
   blink::mojom::AppBannerControllerRequest request =
       mojo::MakeRequest(&app_banner_service_->controller());
-  registry->BindInterface(blink::mojom::AppBannerController::Name_,
-                          request.PassMessagePipe());
+  render_view()->GetMainRenderFrame()->BindLocalInterface(
+      blink::mojom::AppBannerController::Name_, request.PassMessagePipe());
   app_banner_service_->SendBannerPromptRequest(event_platforms, callback);
 }
 
diff --git a/extensions/renderer/extensions_render_frame_observer.cc b/extensions/renderer/extensions_render_frame_observer.cc
index a5a0f991399508..2133e38ae59525 100644
--- a/extensions/renderer/extensions_render_frame_observer.cc
+++ b/extensions/renderer/extensions_render_frame_observer.cc
@@ -81,7 +81,7 @@ ExtensionsRenderFrameObserver::ExtensionsRenderFrameObserver(
     content::RenderFrame* render_frame)
     : content::RenderFrameObserver(render_frame),
       webview_visually_deemphasized_(false) {
-  render_frame->GetInterfaceRegistry()->AddInterface(
+  registry_.AddInterface(
       base::Bind(&ExtensionsRenderFrameObserver::BindAppWindowRequest,
                  base::Unretained(this)));
 }
@@ -105,6 +105,12 @@ void ExtensionsRenderFrameObserver::SetVisuallyDeemphasized(bool deemphasized) {
   render_frame()->GetRenderView()->GetWebView()->SetPageOverlayColor(color);
 }
 
+void ExtensionsRenderFrameObserver::OnInterfaceRequestForFrame(
+    const std::string& interface_name,
+    mojo::ScopedMessagePipeHandle* interface_pipe) {
+  registry_.TryBindInterface(interface_name, interface_pipe);
+}
+
 void ExtensionsRenderFrameObserver::DetailedConsoleMessageAdded(
     const base::string16& message,
     const base::string16& source,
diff --git a/extensions/renderer/extensions_render_frame_observer.h b/extensions/renderer/extensions_render_frame_observer.h
index bfa910f5c73a74..732108cd758f74 100644
--- a/extensions/renderer/extensions_render_frame_observer.h
+++ b/extensions/renderer/extensions_render_frame_observer.h
@@ -11,6 +11,7 @@
 #include "content/public/renderer/render_frame_observer.h"
 #include "extensions/common/mojo/app_window.mojom.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
 
 namespace extensions {
 
@@ -31,6 +32,9 @@ class ExtensionsRenderFrameObserver : public content::RenderFrameObserver,
   void SetVisuallyDeemphasized(bool deemphasized) override;
 
   // RenderFrameObserver implementation.
+  void OnInterfaceRequestForFrame(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle* interface_pipe) override;
   void DetailedConsoleMessageAdded(const base::string16& message,
                                    const base::string16& source,
                                    const base::string16& stack_trace,
@@ -43,6 +47,8 @@ class ExtensionsRenderFrameObserver : public content::RenderFrameObserver,
 
   mojo::BindingSet<mojom::AppWindow> bindings_;
 
+  service_manager::BinderRegistry registry_;
+
   DISALLOW_COPY_AND_ASSIGN(ExtensionsRenderFrameObserver);
 };
 
diff --git a/headless/lib/renderer/headless_render_frame_controller_impl.cc b/headless/lib/renderer/headless_render_frame_controller_impl.cc
index 3ec1b4c5748487..18b980b47497ab 100644
--- a/headless/lib/renderer/headless_render_frame_controller_impl.cc
+++ b/headless/lib/renderer/headless_render_frame_controller_impl.cc
@@ -16,7 +16,7 @@ HeadlessRenderFrameControllerImpl::HeadlessRenderFrameControllerImpl(
     : content::RenderFrameObserver(render_frame),
       render_frame_(render_frame),
       weak_ptr_factory_(this) {
-  render_frame->GetInterfaceRegistry()->AddInterface(base::Bind(
+  registry_.AddInterface(base::Bind(
       &HeadlessRenderFrameControllerImpl::OnRenderFrameControllerRequest,
       base::Unretained(this)));
 }
@@ -68,6 +68,12 @@ void HeadlessRenderFrameControllerImpl::SendMessageToTabSocket(
   find_it->second.OnMessageFromEmbedder(message);
 }
 
+void HeadlessRenderFrameControllerImpl::OnInterfaceRequestForFrame(
+    const std::string& interface_name,
+    mojo::ScopedMessagePipeHandle* interface_pipe) {
+  registry_.TryBindInterface(interface_name, interface_pipe);
+}
+
 void HeadlessRenderFrameControllerImpl::DidCreateScriptContext(
     v8::Local<v8::Context> context,
     int world_id) {
diff --git a/headless/lib/renderer/headless_render_frame_controller_impl.h b/headless/lib/renderer/headless_render_frame_controller_impl.h
index 5e106e8ef737ff..dba52acc74a1a3 100644
--- a/headless/lib/renderer/headless_render_frame_controller_impl.h
+++ b/headless/lib/renderer/headless_render_frame_controller_impl.h
@@ -11,6 +11,7 @@
 #include "headless/lib/renderer/headless_tab_socket_bindings.h"
 #include "headless/lib/tab_socket.mojom.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
 
 namespace headless {
 
@@ -33,6 +34,9 @@ class HeadlessRenderFrameControllerImpl : public HeadlessRenderFrameController,
                               int32_t world_id) override;
 
   // content::RenderFrameObserver implementation:
+  void OnInterfaceRequestForFrame(
+      const std::string& interface_name,
+      mojo::ScopedMessagePipeHandle* interface_pipe) override;
   void DidCreateScriptContext(v8::Local<v8::Context> context,
                               int world_id) override;
 
@@ -51,6 +55,7 @@ class HeadlessRenderFrameControllerImpl : public HeadlessRenderFrameController,
   headless::TabSocketPtr tab_socket_ptr_;
   InstallMainWorldTabSocketCallback
       pending_install_main_world_tab_socket_callback_;
+  service_manager::BinderRegistry registry_;
   base::WeakPtrFactory<HeadlessRenderFrameControllerImpl> weak_ptr_factory_;
 };