diff --git a/pkgs/applications/networking/browsers/chromium/source/default.nix b/pkgs/applications/networking/browsers/chromium/source/default.nix
index 54430bb5be9fb5..a3a46631484587 100644
--- a/pkgs/applications/networking/browsers/chromium/source/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/source/default.nix
@@ -18,7 +18,7 @@ let
     "s,^/,,"
   ]);
 
-  pre42 = versionOlder version "42.0.0.0";
+  pre44 = versionOlder version "44.0.0.0";
 
 in stdenv.mkDerivation {
   name = "chromium-source-${version}";
@@ -47,10 +47,10 @@ in stdenv.mkDerivation {
     done
   '';
 
-  patches = if pre42 then [
-    ./sandbox_userns_36.patch ./nix_plugin_paths.patch
-  ] else [
+  patches = if pre44 then [
     ./nix_plugin_paths_42.patch
+  ] else [
+    ./nix_plugin_paths_44.patch
   ];
 
   patchPhase = let
@@ -73,11 +73,10 @@ in stdenv.mkDerivation {
       -e 's|/bin/echo|echo|' \
       -e "/python_arch/s/: *'[^']*'/: '""'/" \
       "$out/build/common.gypi" "$main/chrome/chrome_tests.gypi"
-  '' + optionalString useOpenSSL ''
-    cat $opensslPatches | patch -p1 -d "$bundled/openssl/openssl"
-  '' + optionalString (!pre42) ''
     sed -i -e '/LOG.*no_suid_error/d' \
       "$main/content/browser/browser_main_loop.cc"
+  '' + optionalString useOpenSSL ''
+    cat $opensslPatches | patch -p1 -d "$bundled/openssl/openssl"
   '';
 
   preferLocalBuild = true;
diff --git a/pkgs/applications/networking/browsers/chromium/source/nix_plugin_paths_44.patch b/pkgs/applications/networking/browsers/chromium/source/nix_plugin_paths_44.patch
new file mode 100644
index 00000000000000..326da7f420a5f0
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/source/nix_plugin_paths_44.patch
@@ -0,0 +1,84 @@
+diff --git a/chrome/common/chrome_paths.cc b/chrome/common/chrome_paths.cc
+index 8a205a6..d5c24e1 100644
+--- a/chrome/common/chrome_paths.cc
++++ b/chrome/common/chrome_paths.cc
+@@ -97,21 +97,14 @@ static base::LazyInstance<base::FilePath>
+     g_invalid_specified_user_data_dir = LAZY_INSTANCE_INITIALIZER;
+ 
+ // Gets the path for internal plugins.
+-bool GetInternalPluginsDirectory(base::FilePath* result) {
+-#if defined(OS_MACOSX) && !defined(OS_IOS)
+-  // If called from Chrome, get internal plugins from a subdirectory of the
+-  // framework.
+-  if (base::mac::AmIBundled()) {
+-    *result = chrome::GetFrameworkBundlePath();
+-    DCHECK(!result->empty());
+-    *result = result->Append("Internet Plug-Ins");
+-    return true;
+-  }
+-  // In tests, just look in the module directory (below).
+-#endif
+-
+-  // The rest of the world expects plugins in the module directory.
+-  return PathService::Get(base::DIR_MODULE, result);
++bool GetInternalPluginsDirectory(base::FilePath* result,
++                                 const std::string& ident) {
++  std::string full_env = std::string("NIX_CHROMIUM_PLUGIN_PATH_") + ident;
++  const char* value = getenv(full_env.c_str());
++  if (value == NULL)
++      return PathService::Get(base::DIR_MODULE, result);
++  else
++      *result = base::FilePath(value);
+ }
+ 
+ }  // namespace
+@@ -248,11 +241,11 @@ bool PathProvider(int key, base::FilePath* result) {
+       create_dir = true;
+       break;
+     case chrome::DIR_INTERNAL_PLUGINS:
+-      if (!GetInternalPluginsDirectory(&cur))
++      if (!GetInternalPluginsDirectory(&cur, "ALL"))
+         return false;
+       break;
+     case chrome::DIR_PEPPER_FLASH_PLUGIN:
+-      if (!GetInternalPluginsDirectory(&cur))
++      if (!GetInternalPluginsDirectory(&cur, "PEPPERFLASH"))
+         return false;
+       cur = cur.Append(kPepperFlashBaseDirectory);
+       break;
+@@ -285,7 +278,7 @@ bool PathProvider(int key, base::FilePath* result) {
+       cur = cur.Append(FILE_PATH_LITERAL("script.log"));
+       break;
+     case chrome::FILE_FLASH_PLUGIN:
+-      if (!GetInternalPluginsDirectory(&cur))
++      if (!GetInternalPluginsDirectory(&cur, "FILEFLASH"))
+         return false;
+       cur = cur.Append(kInternalFlashPluginFileName);
+       break;
+@@ -308,7 +301,7 @@ bool PathProvider(int key, base::FilePath* result) {
+     // We currently need a path here to look up whether the plugin is disabled
+     // and what its permissions are.
+     case chrome::FILE_NACL_PLUGIN:
+-      if (!GetInternalPluginsDirectory(&cur))
++      if (!GetInternalPluginsDirectory(&cur, "NACL"))
+         return false;
+       cur = cur.Append(kInternalNaClPluginFileName);
+       break;
+@@ -343,7 +336,7 @@ bool PathProvider(int key, base::FilePath* result) {
+         cur = cur.DirName();
+       }
+ #else
+-      if (!GetInternalPluginsDirectory(&cur))
++      if (!GetInternalPluginsDirectory(&cur, "PNACL"))
+         return false;
+ #endif
+       cur = cur.Append(FILE_PATH_LITERAL("pnacl"));
+@@ -372,7 +365,7 @@ bool PathProvider(int key, base::FilePath* result) {
+     // In the component case, this is the source adapter. Otherwise, it is the
+     // actual Pepper module that gets loaded.
+     case chrome::FILE_WIDEVINE_CDM_ADAPTER:
+-      if (!GetInternalPluginsDirectory(&cur))
++      if (!GetInternalPluginsDirectory(&cur, "WIDEVINE"))
+         return false;
+       cur = cur.AppendASCII(kWidevineCdmAdapterFileName);
+       break;