diff --git a/src/core/public/ui_settings/ui_settings_client.ts b/src/core/public/ui_settings/ui_settings_client.ts
index ee5d5da8d29b9..a28a2fe8af700 100644
--- a/src/core/public/ui_settings/ui_settings_client.ts
+++ b/src/core/public/ui_settings/ui_settings_client.ts
@@ -33,7 +33,11 @@ export class UiSettingsClient implements IUiSettingsClient {
   constructor(params: UiSettingsClientParams) {
     this.api = params.api;
     this.defaults = cloneDeep(params.defaults);
-    this.cache = defaultsDeep({}, this.defaults, cloneDeep(params.initialSettings));
+    this.cache = defaultsDeep(
+      Object.create(null),
+      this.defaults,
+      cloneDeep(params.initialSettings)
+    );
 
     params.done$.subscribe({
       complete: () => {
@@ -99,7 +103,10 @@ You can use \`IUiSettingsClient.get("${key}", defaultValue)\`, which will just r
   }
 
   isDeclared(key: string) {
-    return key in this.cache;
+    return (
+      // @ts-ignore
+      (key !== '__proto__' || key !== 'constructor' || key !== 'prototype') && key in this.cache
+    );
   }
 
   isDefault(key: string) {