diff --git a/lib/util.js b/lib/util.js
index 098aab24324..07e2e3ba990 100644
--- a/lib/util.js
+++ b/lib/util.js
@@ -378,31 +378,29 @@ function reduceToSingleString(output, base, braces) {
 }
 
 
+// NOTE: These type checking functions intentionally don't use `instanceof`
+// because it is fragile and can be easily faked with `Object.create()`.
 function isArray(ar) {
-  return ar instanceof Array ||
-         Array.isArray(ar) ||
-         (ar && ar !== Object.prototype && isArray(ar.__proto__));
+  return Array.isArray(ar) ||
+         (typeof ar === 'object' && objectToString(ar) === '[object Array]');
 }
 exports.isArray = isArray;
 
 
 function isRegExp(re) {
-  return re instanceof RegExp ||
-      (typeof re === 'object' && objectToString(re) === '[object RegExp]');
+  return typeof re === 'object' && objectToString(re) === '[object RegExp]';
 }
 exports.isRegExp = isRegExp;
 
 
 function isDate(d) {
-  return d instanceof Date ||
-      (typeof d === 'object' && objectToString(d) === '[object Date]');
+  return typeof d === 'object' && objectToString(d) === '[object Date]';
 }
 exports.isDate = isDate;
 
 
 function isError(e) {
-  return e instanceof Error ||
-      (typeof e === 'object' && objectToString(e) === '[object Error]');
+  return typeof e === 'object' && objectToString(e) === '[object Error]';
 }
 exports.isError = isError;