### Description
User reporting that Brave crashes when opening a new tab. So fa…r I'm unable to reproduce.
From the user:
> i tried restarting and disabling news flags in brave://flags, also it’s Brave Nightly
Crash ID: bd220100-b78c-5e0f-0000-000000000000
### Steps to reproduce
1. Open Brave
2. Open a new tab
### Actual result
Brave Crashes
### Expected result
For a new tab to open
### Reproduces how often
Intermittent issue
### Brave version (brave://version info)
[Brave 1.89.100 (Compilação oficial) nightly (64 bits)](https://brave.com/latest/) Chromium: 146.0.7680.32
### Channel information
- [ ] release (stable)
- [ ] beta
- [x] nightly
### Reproducibility
- [ ] with Brave Shields disabled
- [ ] with Brave Rewards disabled
- [ ] in the latest version of Chrome
### Miscellaneous information
Call Stack:
```
[ 00 ] ImmediateCrash() ( immediate_crash.h:180 )
[ 01 ] CheckFailure() ( check.h:258 )
[ 02 ] content::InterfaceRegistrationHelper<BraveNewTabPageUI>::Add<ai_chat::mojom::Service>::<lambda_1>::operator()::<lambda_1>::__invoke(content::WebUIController *,mojo::PendingReceiver<ai_chat::mojom::Service>) ( web_ui_browser_interface_broker_registry.h:36 )
[ 03 ] mojo::internal::BinderContextTraits<content::WebUIController *>::BindGenericFunctor<containers::mojom::ContainersSettingsHandler>((content::WebUIController *,mojo::PendingReceiver<containers::mojom::ContainersSettingsHandler>),content::WebUIController *,mojo::ScopedHandleBase<mojo::MessagePipeHandle>) ( binder_map_internal.h:76 )
[ 04 ] base::internal::DecayedFunctorTraits<void (*)(void (*)(content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>), content::RenderFrameHost *, mojo::ScopedHandleBase<mojo::MessagePipeHandle>),void (*const &)(content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>)>::Invoke(((content::RenderFrameHost *,mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>),content::RenderFrameHost *,mojo::ScopedHandleBase<mojo::MessagePipeHandle>) const &,(content::RenderFrameHost *,mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>) &&,content::RenderFrameHost * &&,mojo::ScopedHandleBase<mojo::MessagePipeHandle> &&) ( bind_internal.h:673 )
[ 05 ] base::internal::InvokeHelper<0,base::internal::FunctorTraits<void (*const &)(void (*)(content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>), content::RenderFrameHost *, mojo::ScopedHandleBase<mojo::MessagePipeHandle>),void (*const &)(content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>)>,void,0>::MakeItSo(((content::RenderFrameHost *,mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>),content::RenderFrameHost *,mojo::ScopedHandleBase<mojo::MessagePipeHandle>) const &,std::__Cr::tuple<base::internal::UnretainedWrapper<void (content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>),base::unretained_traits::MayNotDangle,0> > const &,content::RenderFrameHost * &&,mojo::ScopedHandleBase<mojo::MessagePipeHandle> &&) ( bind_internal.h:932 )
[ 06 ] base::internal::Invoker<base::internal::FunctorTraits<void (*const &)(void (*)(content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>), content::RenderFrameHost *, mojo::ScopedHandleBase<mojo::MessagePipeHandle>),void (*const &)(content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>)>,base::internal::BindState<0,1,0,void (*)(void (*)(content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>), content::RenderFrameHost *, mojo::ScopedHandleBase<mojo::MessagePipeHandle>),base::internal::UnretainedWrapper<void (content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>),base::unretained_traits::MayNotDangle,0> >,void (content::RenderFrameHost *, mojo::ScopedHandleBase<mojo::MessagePipeHandle>)>::RunImpl(((content::RenderFrameHost *,mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>),content::RenderFrameHost *,mojo::ScopedHandleBase<mojo::MessagePipeHandle>) const &,std::__Cr::tuple<base::internal::UnretainedWrapper<void (content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>),base::unretained_traits::MayNotDangle,0> > const &,std::__Cr::integer_sequence<unsigned long long,0>,content::RenderFrameHost * &&,mojo::ScopedHandleBase<mojo::MessagePipeHandle> &&) ( bind_internal.h:1069 )
[ 07 ] base::internal::Invoker<base::internal::FunctorTraits<void (*const &)(void (*)(content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>), content::RenderFrameHost *, mojo::ScopedHandleBase<mojo::MessagePipeHandle>),void (*const &)(content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>)>,base::internal::BindState<0,1,0,void (*)(void (*)(content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>), content::RenderFrameHost *, mojo::ScopedHandleBase<mojo::MessagePipeHandle>),base::internal::UnretainedWrapper<void (content::RenderFrameHost *, mojo::PendingReceiver<blink::mojom::AnchorElementMetricsHost>),base::unretained_traits::MayNotDangle,0> >,void (content::RenderFrameHost *, mojo::ScopedHandleBase<mojo::MessagePipeHandle>)>::Run(base::internal::BindStateBase *,content::RenderFrameHost *,mojo::ScopedHandleBase<mojo::MessagePipeHandle> &&) ( bind_internal.h:989 )
[ 08 ] base::RepeatingCallback<void (content::WebUIController *, mojo::ScopedHandleBase<mojo::MessagePipeHandle>)>::Run(content::WebUIController *,mojo::ScopedHandleBase<mojo::MessagePipeHandle>) ( callback.h:344 )
[ 09 ] mojo::internal::GenericCallbackBinderWithContext<content::WebUIController *>::RunCallbackWithContext(base::RepeatingCallback<void (content::WebUIController *, mojo::ScopedHandleBase<mojo::MessagePipeHandle>)> const &,content::WebUIController *,mojo::ScopedHandleBase<mojo::MessagePipeHandle>) ( binder_map_internal.h:187 )
[ 10 ] mojo::internal::GenericCallbackBinderWithContext<content::WebUIController *>::BindInterface(content::WebUIController *,mojo::ScopedHandleBase<mojo::MessagePipeHandle>) ( binder_map_internal.h:160 )
[ 11 ] std::__Cr::optional<std::__Cr::basic_string<char,std::__Cr::char_traits<char>,std::__Cr::allocator<char> > >::operator*() ( optional:1064 )
[ 12 ] mojo::BinderMapWithContext<content::WebUIController *>::TryBind(content::WebUIController *,mojo::GenericPendingReceiver *) ( binder_map.h:195 )
[ 13 ] content::PerWebUIBrowserInterfaceBroker::GetInterface(mojo::GenericPendingReceiver) ( per_web_ui_browser_interface_broker.cc:39 )
[ 14 ] blink::mojom::BrowserInterfaceBrokerStubDispatch::Accept(blink::mojom::BrowserInterfaceBroker *,mojo::Message *) ( browser_interface_broker.mojom.cc:192 )
[ 15 ] mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message *) ( interface_endpoint_client.cc:1085 )
[ 16 ] mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept(mojo::Message *) ( interface_endpoint_client.cc:383 )
[ 17 ] mojo::MessageDispatcher::Accept(mojo::Message *) ( message_dispatcher.cc:44 )
```