AIKIDO-2026-722550

TL;DR

React Native Worklets clones plain JavaScript objects during serialization in clonePlainJSObject by assigning each source key directly onto a plain {} clone target. When the object being cloned contains a __proto__ key, that assignment mutates the clone's prototype instead of creating an own __proto__ property, corrupting the object Worklets later processes. When externally influenced data containing a __proto__ key reaches a shared value and is passed through this serialization path, React Native Worklets crashes, and persisted data can trigger the crash again on later access. The fix clones into a null-prototype object and materializes __proto__ as an own data property instead of assigning it through the default setter.