diff --git a/front_end/models/trace/handlers/FramesHandler.ts b/front_end/models/trace/handlers/FramesHandler.ts
index d1483495566..d7bab3ca0cd 100644
--- a/front_end/models/trace/handlers/FramesHandler.ts
+++ b/front_end/models/trace/handlers/FramesHandler.ts
@@ -506,8 +506,10 @@ class BeginFrameInfo {
 export class TimelineFrameBeginFrameQueue {
   private queueFrames: number[] = [];
 
-  // Maps frameSeqId to BeginFrameInfo.
-  private mapFrames: Record<number, BeginFrameInfo> = {};
+  // Maps frameSeqId to BeginFrameInfo. Use a null-prototype object so that
+  // attacker-controlled frameSeqId values from a loaded trace (e.g.
+  // "__proto__") cannot reach Object.prototype via `in` / bracket-write.
+  private mapFrames: Record<number, BeginFrameInfo> = Object.create(null);
 
   // Add a BeginFrame to the queue, if it does not already exit.
   addFrameIfNotExists(seqId: number, startTime: Types.Timing.Micro, isDropped: boolean, isPartial: boolean): void {