3rd try. *sigh*...

chrome_frame/bho.h

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_FRAME_BHO_H_
 #define CHROME_FRAME_BHO_H_
 
 #include <atlbase.h>
 #include <atlcom.h>
+#include <deletebrowsinghistory.h>
 #include <exdisp.h>
 #include <exdispid.h>
 #include <mshtml.h>
 #include <shdeprecated.h>
 
 #include <string>
 
 #include "base/scoped_comptr_win.h"
 #include "chrome_tab.h"  // NOLINT
+#include "chrome_frame/delete_chrome_history.h"
 #include "chrome_frame/resource.h"
 #include "chrome_frame/urlmon_moniker.h"
 #include "chrome_frame/urlmon_url_request.h"
 #include "grit/chrome_frame_resources.h"
 
+class DeleteChromeHistory;
+
 class PatchHelper {
  public:
   enum State { UNKNOWN, PATCH_IBROWSER, PATCH_PROTOCOL };
   PatchHelper() : state_(UNKNOWN) {
   }
 
   State state() const {
     return state_;
   }
 
@@ skipping 14 matching lines @@
   : public CComObjectRootEx<CComSingleThreadModel>,
     public CComCoClass<Bho, &CLSID_ChromeFrameBHO>,
     public IObjectWithSiteImpl<Bho>,
     public IDispEventSimpleImpl<0, Bho, &DIID_DWebBrowserEvents2>,
     public NavigationManager {
  public:
   typedef HRESULT (STDMETHODCALLTYPE* IBrowserService_OnHttpEquiv_Fn)(
       IBrowserService* browser, IShellView* shell_view, BOOL done,
       VARIANT* in_arg, VARIANT* out_arg);
 
+DECLARE_GET_CONTROLLING_UNKNOWN()
 DECLARE_REGISTRY_RESOURCEID(IDR_BHO)
 DECLARE_NOT_AGGREGATABLE(Bho)
 DECLARE_PROTECT_FINAL_CONSTRUCT()
 
 BEGIN_COM_MAP(Bho)
   COM_INTERFACE_ENTRY(IObjectWithSite)
+  // When calling DeleteChromeHistory, ensure that only one instance
+  // is created to avoid mulitple message loops.
+  COM_INTERFACE_ENTRY_CACHED_TEAR_OFF(IID_IDeleteBrowsingHistory,
+                                      DeleteChromeHistory,
+                                      delete_chrome_history_.p)
 END_COM_MAP()
 
 BEGIN_SINK_MAP(Bho)
   SINK_ENTRY_INFO(0, DIID_DWebBrowserEvents2, DISPID_BEFORENAVIGATE2,
                   BeforeNavigate2, &kBeforeNavigate2Info)
   SINK_ENTRY_INFO(0, DIID_DWebBrowserEvents2, DISPID_NAVIGATECOMPLETE2,
                   NavigateComplete2, &kNavigateComplete2Info)
 END_SINK_MAP()
 
   Bho();
@@ skipping 15 matching lines @@
   // us to sniff the META tag by simply patching it. The renderer
   // switching can be achieved by canceling original navigation
   // and issuing a new one using IWebBrowser2->Navigate2.
   static HRESULT STDMETHODCALLTYPE OnHttpEquiv(
       IBrowserService_OnHttpEquiv_Fn original_httpequiv,
       IBrowserService* browser, IShellView* shell_view, BOOL done,
       VARIANT* in_arg, VARIANT* out_arg);
 
   static void ProcessOptInUrls(IWebBrowser2* browser, BSTR url);
 
+  // COM_INTERFACE_ENTRY_CACHED_TEAR_OFF manages the raw pointer from CComPtr
+  // which ScopedComPtr doesn't expose.
+  CComPtr<IUnknown> delete_chrome_history_;
+
  protected:
   bool PatchProtocolHandler(const CLSID& handler_clsid);
 
   static _ATL_FUNC_INFO kBeforeNavigate2Info;
   static _ATL_FUNC_INFO kNavigateComplete2Info;
 };
 
 #endif  // CHROME_FRAME_BHO_H_