diff --git a/Userland/Libraries/LibWeb/Bindings/HostDefined.cpp b/Userland/Libraries/LibWeb/Bindings/HostDefined.cpp
new file mode 100644
index 0000000000..3d4a8d6ac4
--- /dev/null
+++ b/Userland/Libraries/LibWeb/Bindings/HostDefined.cpp
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2022, Andrew Kaster <akaster@serenityos.org>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#include <LibJS/Heap/Cell.h>
+#include <LibJS/Runtime/Realm.h>
+#include <LibWeb/Bindings/HostDefined.h>
+#include <LibWeb/Bindings/Intrinsics.h>
+#include <LibWeb/HTML/Scripting/Environments.h>
+
+namespace Web::Bindings {
+
+void HostDefined::visit_edges(JS::Cell::Visitor& visitor)
+{
+    JS::Realm::HostDefined::visit_edges(visitor);
+    visitor.visit(environment_settings_object);
+    visitor.visit(*intrinsics);
+}
+
+}
diff --git a/Userland/Libraries/LibWeb/Bindings/HostDefined.h b/Userland/Libraries/LibWeb/Bindings/HostDefined.h
new file mode 100644
index 0000000000..d4152bb517
--- /dev/null
+++ b/Userland/Libraries/LibWeb/Bindings/HostDefined.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2022, Andrew Kaster <akaster@serenityos.org>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#pragma once
+
+#include <AK/TypeCasts.h>
+#include <LibJS/Heap/GCPtr.h>
+#include <LibJS/Runtime/Realm.h>
+#include <LibWeb/Forward.h>
+
+namespace Web::Bindings {
+
+struct HostDefined : public JS::Realm::HostDefined {
+    HostDefined(JS::GCPtr<HTML::EnvironmentSettingsObject> eso, JS::NonnullGCPtr<Intrinsics> intrinsics)
+        : environment_settings_object(eso)
+        , intrinsics(intrinsics)
+    {
+    }
+    virtual ~HostDefined() override = default;
+    virtual void visit_edges(JS::Cell::Visitor& visitor) override;
+
+    // NOTE: Only the root execution environment in the main thread VM ever sets this to nullptr
+    JS::GCPtr<HTML::EnvironmentSettingsObject> environment_settings_object;
+    JS::NonnullGCPtr<Intrinsics> intrinsics;
+};
+
+inline HTML::EnvironmentSettingsObject& host_defined_environment_settings_object(JS::Realm& realm)
+{
+    return *verify_cast<HostDefined>(realm.host_defined())->environment_settings_object;
+}
+
+}
diff --git a/Userland/Libraries/LibWeb/Bindings/Intrinsics.cpp b/Userland/Libraries/LibWeb/Bindings/Intrinsics.cpp
new file mode 100644
index 0000000000..e133374317
--- /dev/null
+++ b/Userland/Libraries/LibWeb/Bindings/Intrinsics.cpp
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2022, Andrew Kaster <akaster@serenityos.org>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#include <AK/HashMap.h>
+#include <AK/String.h>
+#include <LibJS/Forward.h>
+#include <LibJS/Runtime/NativeFunction.h>
+#include <LibJS/Runtime/Object.h>
+#include <LibWeb/Bindings/Intrinsics.h>
+
+namespace Web::Bindings {
+
+JS::Object& Intrinsics::cached_web_prototype(String const& class_name)
+{
+    auto it = m_prototypes.find(class_name);
+    if (it == m_prototypes.end()) {
+        dbgln("Missing prototype: {}", class_name);
+    }
+    VERIFY(it != m_prototypes.end());
+    return *it->value;
+}
+
+void Intrinsics::visit_edges(JS::Cell::Visitor& visitor)
+{
+    Base::visit_edges(visitor);
+
+    for (auto& it : m_prototypes)
+        visitor.visit(it.value);
+    for (auto& it : m_constructors)
+        visitor.visit(it.value);
+}
+
+}
diff --git a/Userland/Libraries/LibWeb/Bindings/Intrinsics.h b/Userland/Libraries/LibWeb/Bindings/Intrinsics.h
new file mode 100644
index 0000000000..02f0601da8
--- /dev/null
+++ b/Userland/Libraries/LibWeb/Bindings/Intrinsics.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2022, Andrew Kaster <akaster@serenityos.org>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#pragma once
+
+#include <AK/Forward.h>
+#include <AK/HashMap.h>
+#include <LibJS/Forward.h>
+#include <LibJS/Heap/Cell.h>
+#include <LibJS/Heap/Heap.h>
+#include <LibJS/Runtime/VM.h>
+#include <LibWeb/Bindings/HostDefined.h>
+
+namespace Web::Bindings {
+
+class Intrinsics final : public JS::Cell {
+    JS_CELL(Intrinsics, JS::Cell);
+
+public:
+    Intrinsics(JS::Realm& realm)
+        : m_realm(realm)
+    {
+    }
+
+    JS::Object& cached_web_prototype(String const& class_name);
+
+    template<typename T>
+    JS::Object& ensure_web_prototype(String const& class_name)
+    {
+        auto it = m_prototypes.find(class_name);
+        if (it != m_prototypes.end())
+            return *it->value;
+        auto& realm = *m_realm;
+        auto* prototype = heap().allocate<T>(realm, realm);
+        m_prototypes.set(class_name, prototype);
+        return *prototype;
+    }
+
+    template<typename T>
+    JS::NativeFunction& ensure_web_constructor(String const& class_name)
+    {
+        auto it = m_constructors.find(class_name);
+        if (it != m_constructors.end())
+            return *it->value;
+        auto& realm = *m_realm;
+        auto* constructor = heap().allocate<T>(realm, realm);
+        m_constructors.set(class_name, constructor);
+        return *constructor;
+    }
+
+private:
+    virtual void visit_edges(JS::Cell::Visitor&) override;
+
+    HashMap<String, JS::Object*> m_prototypes;
+    HashMap<String, JS::NativeFunction*> m_constructors;
+
+    JS::NonnullGCPtr<JS::Realm> m_realm;
+};
+
+inline Intrinsics& host_defined_intrinsics(JS::Realm& realm)
+{
+    return *verify_cast<HostDefined>(realm.host_defined())->intrinsics;
+}
+
+template<typename T>
+JS::Object& ensure_web_prototype(JS::Realm& realm, String const& class_name)
+{
+    return host_defined_intrinsics(realm).ensure_web_prototype<T>(class_name);
+}
+
+template<typename T>
+JS::NativeFunction& ensure_web_constructor(JS::Realm& realm, String const& class_name)
+{
+    return host_defined_intrinsics(realm).ensure_web_constructor<T>(class_name);
+}
+
+inline JS::Object& cached_web_prototype(JS::Realm& realm, String const& class_name)
+{
+    return host_defined_intrinsics(realm).cached_web_prototype(class_name);
+}
+
+}
diff --git a/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp b/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp
index 421e580ddf..8e90f654ae 100644
--- a/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp
+++ b/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp
@@ -11,6 +11,7 @@
 #include <LibJS/Runtime/FinalizationRegistry.h>
 #include <LibJS/Runtime/NativeFunction.h>
 #include <LibJS/Runtime/VM.h>
+#include <LibWeb/Bindings/Intrinsics.h>
 #include <LibWeb/Bindings/LocationObject.h>
 #include <LibWeb/Bindings/MainThreadVM.h>
 #include <LibWeb/DOM/Document.h>
@@ -181,7 +182,7 @@ JS::VM& main_thread_vm()
             // 2. Queue a global task on the JavaScript engine task source given global to perform the following steps:
             HTML::queue_global_task(HTML::Task::Source::JavaScriptEngine, global, [&finalization_registry]() mutable {
                 // 1. Let entry be finalizationRegistry.[[CleanupCallback]].[[Callback]].[[Realm]]'s environment settings object.
-                auto& entry = verify_cast<HTML::EnvironmentSettingsObject>(*finalization_registry.cleanup_callback().callback.cell()->realm()->host_defined());
+                auto& entry = host_defined_environment_settings_object(*finalization_registry.cleanup_callback().callback.cell()->realm());
 
                 // 2. Check if we can run script with entry. If this returns "do not run", then return.
                 if (entry.can_run_script() == HTML::RunScriptDecision::DoNotRun)
@@ -207,7 +208,7 @@ JS::VM& main_thread_vm()
             // 1. If realm is not null, then let job settings be the settings object for realm. Otherwise, let job settings be null.
             HTML::EnvironmentSettingsObject* job_settings { nullptr };
             if (realm)
-                job_settings = verify_cast<HTML::EnvironmentSettingsObject>(realm->host_defined());
+                job_settings = &host_defined_environment_settings_object(*realm);
 
             // IMPLEMENTATION DEFINED: The JS spec says we must take implementation defined steps to make the currently active script or module at the time of HostEnqueuePromiseJob being invoked
             //                         also be the active script or module of the job at the time of its invocation.
@@ -312,6 +313,11 @@ JS::VM& main_thread_vm()
             },
             nullptr));
 
+        auto* root_realm = custom_data.root_execution_context->realm;
+        auto* intrinsics = root_realm->heap().allocate<Intrinsics>(*root_realm, *root_realm);
+        auto host_defined = make<HostDefined>(nullptr, *intrinsics);
+        root_realm->set_host_defined(move(host_defined));
+
         vm->push_execution_context(*custom_data.root_execution_context);
     }
     return *vm;
diff --git a/Userland/Libraries/LibWeb/Bindings/WindowObjectHelper.h b/Userland/Libraries/LibWeb/Bindings/WindowObjectHelper.h
index 84f60d0932..50fcfda5c0 100644
--- a/Userland/Libraries/LibWeb/Bindings/WindowObjectHelper.h
+++ b/Userland/Libraries/LibWeb/Bindings/WindowObjectHelper.h
@@ -394,8 +394,9 @@
 
 #define ADD_WINDOW_OBJECT_CONSTRUCTOR_AND_PROTOTYPE(interface_name, constructor_name, prototype_name)                                \
     {                                                                                                                                \
-        auto& prototype = ensure_web_prototype<Bindings::prototype_name>(#interface_name);                                           \
-        auto& constructor = ensure_web_constructor<Bindings::constructor_name>(#interface_name);                                     \
+        auto& prototype = Bindings::ensure_web_prototype<Bindings::prototype_name>(realm, #interface_name);                          \
+        auto& constructor = Bindings::ensure_web_constructor<Bindings::constructor_name>(realm, #interface_name);                    \
+        define_direct_property(#interface_name, &constructor, JS::Attribute::Writable | JS::Attribute::Configurable);                \
         prototype.define_direct_property(vm.names.constructor, &constructor, JS::Attribute::Writable | JS::Attribute::Configurable); \
         constructor.define_direct_property(vm.names.name, js_string(vm, #interface_name), JS::Attribute::Configurable);              \
     }
@@ -405,6 +406,7 @@
 
 #define ADD_WINDOW_OBJECT_INTERFACES                                                                \
     auto& vm = this->vm();                                                                          \
+    auto& realm = this->realm();                                                                    \
     ADD_WINDOW_OBJECT_INTERFACE(AbortController)                                                    \
     ADD_WINDOW_OBJECT_INTERFACE(AbortSignal)                                                        \
     ADD_WINDOW_OBJECT_INTERFACE(AbstractRange)                                                      \
diff --git a/Userland/Libraries/LibWeb/CMakeLists.txt b/Userland/Libraries/LibWeb/CMakeLists.txt
index 0633930fea..867988cc29 100644
--- a/Userland/Libraries/LibWeb/CMakeLists.txt
+++ b/Userland/Libraries/LibWeb/CMakeLists.txt
@@ -3,7 +3,9 @@ include(libweb_generators)
 set(SOURCES
     Bindings/AudioConstructor.cpp
     Bindings/CSSNamespace.cpp
+    Bindings/HostDefined.cpp
     Bindings/ImageConstructor.cpp
+    Bindings/Intrinsics.cpp
     Bindings/LegacyPlatformObject.cpp
     Bindings/LocationConstructor.cpp
     Bindings/LocationObject.cpp
diff --git a/Userland/Libraries/LibWeb/DOM/Document.cpp b/Userland/Libraries/LibWeb/DOM/Document.cpp
index 317fb3163d..e2c5ca2c0d 100644
--- a/Userland/Libraries/LibWeb/DOM/Document.cpp
+++ b/Userland/Libraries/LibWeb/DOM/Document.cpp
@@ -1087,7 +1087,7 @@ Color Document::visited_link_color() const
 HTML::EnvironmentSettingsObject& Document::relevant_settings_object()
 {
     // Then, the relevant settings object for a platform object o is the environment settings object of the relevant Realm for o.
-    return verify_cast<HTML::EnvironmentSettingsObject>(*realm().host_defined());
+    return Bindings::host_defined_environment_settings_object(realm());
 }
 
 JS::Value Document::run_javascript(StringView source, StringView filename)
diff --git a/Userland/Libraries/LibWeb/DOM/EventTarget.cpp b/Userland/Libraries/LibWeb/DOM/EventTarget.cpp
index df1b6855ef..244cad529e 100644
--- a/Userland/Libraries/LibWeb/DOM/EventTarget.cpp
+++ b/Userland/Libraries/LibWeb/DOM/EventTarget.cpp
@@ -556,7 +556,7 @@ void EventTarget::activate_event_handler(FlyString const& name, HTML::EventHandl
         0, "", &realm);
 
     // NOTE: As per the spec, the callback context is arbitrary.
-    auto* callback = realm.heap().allocate_without_realm<WebIDL::CallbackType>(*callback_function, verify_cast<HTML::EnvironmentSettingsObject>(*realm.host_defined()));
+    auto* callback = realm.heap().allocate_without_realm<WebIDL::CallbackType>(*callback_function, Bindings::host_defined_environment_settings_object(realm));
 
     // 5. Let listener be a new event listener whose type is the event handler event type corresponding to eventHandler and callback is callback.
     auto* listener = realm.heap().allocate_without_realm<DOMEventListener>();
diff --git a/Userland/Libraries/LibWeb/Forward.h b/Userland/Libraries/LibWeb/Forward.h
index d2f0b3c791..f225fdd09a 100644
--- a/Userland/Libraries/LibWeb/Forward.h
+++ b/Userland/Libraries/LibWeb/Forward.h
@@ -473,6 +473,7 @@ class URLSearchParamsIterator;
 }
 
 namespace Web::Bindings {
+class Intrinsics;
 class LocationObject;
 class OptionConstructor;
 class RangePrototype;
diff --git a/Userland/Libraries/LibWeb/HTML/BrowsingContext.cpp b/Userland/Libraries/LibWeb/HTML/BrowsingContext.cpp
index e90f88cae1..674dca3d5a 100644
--- a/Userland/Libraries/LibWeb/HTML/BrowsingContext.cpp
+++ b/Userland/Libraries/LibWeb/HTML/BrowsingContext.cpp
@@ -164,7 +164,7 @@ NonnullRefPtr<BrowsingContext> BrowsingContext::create_a_new_browsing_context(Pa
     auto load_timing_info = DOM::DocumentLoadTimingInfo();
     load_timing_info.navigation_start_time = HighResolutionTime::coarsen_time(
         unsafe_context_creation_time,
-        verify_cast<WindowEnvironmentSettingsObject>(window->realm().host_defined())->cross_origin_isolated_capability() == CanUseCrossOriginIsolatedAPIs::Yes);
+        verify_cast<WindowEnvironmentSettingsObject>(Bindings::host_defined_environment_settings_object(window->realm())).cross_origin_isolated_capability() == CanUseCrossOriginIsolatedAPIs::Yes);
 
     // 13. Let coop be a new cross-origin opener policy.
     auto coop = CrossOriginOpenerPolicy {};
diff --git a/Userland/Libraries/LibWeb/HTML/Scripting/Environments.cpp b/Userland/Libraries/LibWeb/HTML/Scripting/Environments.cpp
index b35390f70d..e28b49922d 100644
--- a/Userland/Libraries/LibWeb/HTML/Scripting/Environments.cpp
+++ b/Userland/Libraries/LibWeb/HTML/Scripting/Environments.cpp
@@ -286,7 +286,7 @@ EnvironmentSettingsObject& incumbent_settings_object()
     }
 
     // 3. Return context's Realm component's settings object.
-    return verify_cast<EnvironmentSettingsObject>(*context->realm->host_defined());
+    return Bindings::host_defined_environment_settings_object(*context->realm);
 }
 
 // https://html.spec.whatwg.org/multipage/webappapis.html#concept-incumbent-realm
@@ -310,7 +310,7 @@ EnvironmentSettingsObject& current_settings_object()
     auto& vm = event_loop.vm();
 
     // Then, the current settings object is the environment settings object of the current Realm Record.
-    return verify_cast<EnvironmentSettingsObject>(*vm.current_realm()->host_defined());
+    return Bindings::host_defined_environment_settings_object(*vm.current_realm());
 }
 
 // https://html.spec.whatwg.org/multipage/webappapis.html#current-global-object
@@ -334,7 +334,7 @@ JS::Realm& relevant_realm(JS::Object const& object)
 EnvironmentSettingsObject& relevant_settings_object(JS::Object const& object)
 {
     // Then, the relevant settings object for a platform object o is the environment settings object of the relevant Realm for o.
-    return verify_cast<EnvironmentSettingsObject>(*relevant_realm(object).host_defined());
+    return Bindings::host_defined_environment_settings_object(relevant_realm(object));
 }
 
 EnvironmentSettingsObject& relevant_settings_object(DOM::Node const& node)
diff --git a/Userland/Libraries/LibWeb/HTML/Scripting/Environments.h b/Userland/Libraries/LibWeb/HTML/Scripting/Environments.h
index c8fee5dd64..c2f34b1466 100644
--- a/Userland/Libraries/LibWeb/HTML/Scripting/Environments.h
+++ b/Userland/Libraries/LibWeb/HTML/Scripting/Environments.h
@@ -54,7 +54,9 @@ enum class RunScriptDecision {
 // https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object
 struct EnvironmentSettingsObject
     : public Environment
-    , public JS::Realm::HostDefined {
+    , public JS::Cell {
+    JS_CELL(EnvironmentSettingsObject, JS::Cell);
+
     virtual ~EnvironmentSettingsObject() override;
 
     // https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-target-browsing-context
diff --git a/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.cpp b/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.cpp
index ad343bc023..94e861c64b 100644
--- a/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.cpp
+++ b/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.cpp
@@ -4,6 +4,8 @@
  * SPDX-License-Identifier: BSD-2-Clause
  */
 
+#include <LibWeb/Bindings/HostDefined.h>
+#include <LibWeb/Bindings/Intrinsics.h>
 #include <LibWeb/DOM/Document.h>
 #include <LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.h>
 #include <LibWeb/HTML/Window.h>
@@ -36,7 +38,7 @@ void WindowEnvironmentSettingsObject::setup(AK::URL const& creation_url, Nonnull
 
     // 3. Let settings object be a new environment settings object whose algorithms are defined as follows:
     // NOTE: See the functions defined for this class.
-    auto settings_object = adopt_own(*new WindowEnvironmentSettingsObject(window, move(execution_context)));
+    auto* settings_object = realm->heap().allocate<WindowEnvironmentSettingsObject>(*realm, window, move(execution_context));
 
     // 4. If reservedEnvironment is non-null, then:
     if (reserved_environment.has_value()) {
@@ -68,7 +70,14 @@ void WindowEnvironmentSettingsObject::setup(AK::URL const& creation_url, Nonnull
     settings_object->top_level_origin = top_level_origin;
 
     // 7. Set realm's [[HostDefined]] field to settings object.
-    realm->set_host_defined(move(settings_object));
+    // Non-Standard: We store the ESO next to the web intrinsics in a custom HostDefined object
+    auto* intrinsics = realm->heap().allocate<Bindings::Intrinsics>(*realm, *realm);
+    auto host_defined = make<Bindings::HostDefined>(*settings_object, *intrinsics);
+    realm->set_host_defined(move(host_defined));
+
+    // Non-Standard: We cannot fully initialize window object until *after* the we set up
+    //    the realm's [[HostDefined]] internal slot as the internal slot contains the web platform intrinsics
+    window.initialize_web_interfaces({});
 }
 
 // https://html.spec.whatwg.org/multipage/window-object.html#script-settings-for-window-objects:responsible-document
diff --git a/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.h b/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.h
index 48f3196d0e..47c25d9e85 100644
--- a/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.h
+++ b/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.h
@@ -12,6 +12,8 @@
 namespace Web::HTML {
 
 class WindowEnvironmentSettingsObject final : public EnvironmentSettingsObject {
+    JS_CELL(WindowEnvironmentSettingsObject, EnvironmentSettingsObject);
+
 public:
     static void setup(AK::URL const& creation_url, NonnullOwnPtr<JS::ExecutionContext>, Optional<Environment>, AK::URL top_level_creation_url, Origin top_level_origin);
 
diff --git a/Userland/Libraries/LibWeb/HTML/Scripting/WorkerEnvironmentSettingsObject.h b/Userland/Libraries/LibWeb/HTML/Scripting/WorkerEnvironmentSettingsObject.h
index 8631a88cd8..cac5fb546a 100644
--- a/Userland/Libraries/LibWeb/HTML/Scripting/WorkerEnvironmentSettingsObject.h
+++ b/Userland/Libraries/LibWeb/HTML/Scripting/WorkerEnvironmentSettingsObject.h
@@ -13,23 +13,27 @@
 namespace Web::HTML {
 
 class WorkerEnvironmentSettingsObject final
-    : public EnvironmentSettingsObject
-    , public Weakable<WorkerEnvironmentSettingsObject> {
+    : public EnvironmentSettingsObject {
+    JS_CELL(WindowEnvironmentSettingsObject, EnvironmentSettingsObject);
+
 public:
     WorkerEnvironmentSettingsObject(NonnullOwnPtr<JS::ExecutionContext> execution_context)
         : EnvironmentSettingsObject(move(execution_context))
     {
     }
 
-    static WeakPtr<WorkerEnvironmentSettingsObject> setup(NonnullOwnPtr<JS::ExecutionContext> execution_context /* FIXME: null or an environment reservedEnvironment, a URL topLevelCreationURL, and an origin topLevelOrigin */)
+    static JS::NonnullGCPtr<WorkerEnvironmentSettingsObject> setup(NonnullOwnPtr<JS::ExecutionContext> execution_context /* FIXME: null or an environment reservedEnvironment, a URL topLevelCreationURL, and an origin topLevelOrigin */)
     {
         auto* realm = execution_context->realm;
         VERIFY(realm);
-        auto settings_object = adopt_own(*new WorkerEnvironmentSettingsObject(move(execution_context)));
+        auto settings_object = realm->heap().allocate<WorkerEnvironmentSettingsObject>(*realm, move(execution_context));
         settings_object->target_browsing_context = nullptr;
-        realm->set_host_defined(move(settings_object));
 
-        return static_cast<WorkerEnvironmentSettingsObject*>(realm->host_defined());
+        auto* intrinsics = realm->heap().allocate<Bindings::Intrinsics>(*realm, *realm);
+        auto host_defined = make<Bindings::HostDefined>(*settings_object, *intrinsics);
+        realm->set_host_defined(move(host_defined));
+
+        return *settings_object;
     }
 
     virtual ~WorkerEnvironmentSettingsObject() override = default;
diff --git a/Userland/Libraries/LibWeb/HTML/Window.cpp b/Userland/Libraries/LibWeb/HTML/Window.cpp
index 29e911bb8c..22a5c0cfaa 100644
--- a/Userland/Libraries/LibWeb/HTML/Window.cpp
+++ b/Userland/Libraries/LibWeb/HTML/Window.cpp
@@ -96,26 +96,12 @@ void Window::visit_edges(JS::Cell::Visitor& visitor)
     visitor.visit(m_screen.ptr());
     visitor.visit(m_location_object);
     visitor.visit(m_crypto);
-    for (auto& it : m_prototypes)
-        visitor.visit(it.value);
-    for (auto& it : m_constructors)
-        visitor.visit(it.value);
     for (auto& it : m_timers)
         visitor.visit(it.value.ptr());
 }
 
 Window::~Window() = default;
 
-JS::Object& Window::cached_web_prototype(String const& class_name)
-{
-    auto it = m_prototypes.find(class_name);
-    if (it == m_prototypes.end()) {
-        dbgln("Missing prototype: {}", class_name);
-    }
-    VERIFY(it != m_prototypes.end());
-    return *it->value;
-}
-
 HighResolutionTime::Performance& Window::performance()
 {
     if (!m_performance)
@@ -750,7 +736,10 @@ void Window::initialize(JS::Realm& realm)
 
     // FIXME: This is a hack..
     realm.set_global_object(this, this);
+}
 
+void Window::initialize_web_interfaces(Badge<WindowEnvironmentSettingsObject>)
+{
     ADD_WINDOW_OBJECT_INTERFACES;
 
     Object::set_prototype(&ensure_web_prototype<Bindings::WindowPrototype>("Window"));
diff --git a/Userland/Libraries/LibWeb/HTML/Window.h b/Userland/Libraries/LibWeb/HTML/Window.h
index 0f9c09e464..22f855564a 100644
--- a/Userland/Libraries/LibWeb/HTML/Window.h
+++ b/Userland/Libraries/LibWeb/HTML/Window.h
@@ -13,6 +13,7 @@
 #include <AK/TypeCasts.h>
 #include <AK/URL.h>
 #include <LibJS/Heap/Heap.h>
+#include <LibWeb/Bindings/Intrinsics.h>
 #include <LibWeb/DOM/EventTarget.h>
 #include <LibWeb/Forward.h>
 #include <LibWeb/HTML/AnimationFrameCallbackDriver.h>
@@ -123,6 +124,8 @@ public:
     // https://html.spec.whatwg.org/multipage/interaction.html#transient-activation
     bool has_transient_activation() const;
 
+    void initialize_web_interfaces(Badge<WindowEnvironmentSettingsObject>);
+
 private:
     explicit Window(JS::Realm&);
     virtual void initialize(JS::Realm&) override;
@@ -170,34 +173,18 @@ public:
     Bindings::LocationObject* location_object() { return m_location_object; }
     Bindings::LocationObject const* location_object() const { return m_location_object; }
 
-    JS::Object* web_prototype(String const& class_name) { return m_prototypes.get(class_name).value_or(nullptr); }
-    JS::NativeFunction* web_constructor(String const& class_name) { return m_constructors.get(class_name).value_or(nullptr); }
-
-    JS::Object& cached_web_prototype(String const& class_name);
+    JS::Object& cached_web_prototype(String const& class_name) { return Bindings::cached_web_prototype(realm(), class_name); }
 
     template<typename T>
     JS::Object& ensure_web_prototype(String const& class_name)
     {
-        auto it = m_prototypes.find(class_name);
-        if (it != m_prototypes.end())
-            return *it->value;
-        auto& realm = shape().realm();
-        auto* prototype = heap().allocate<T>(realm, realm);
-        m_prototypes.set(class_name, prototype);
-        return *prototype;
+        return Bindings::ensure_web_prototype<T>(realm(), class_name);
     }
 
     template<typename T>
     JS::NativeFunction& ensure_web_constructor(String const& class_name)
     {
-        auto it = m_constructors.find(class_name);
-        if (it != m_constructors.end())
-            return *it->value;
-        auto& realm = shape().realm();
-        auto* constructor = heap().allocate<T>(realm, realm);
-        m_constructors.set(class_name, constructor);
-        define_direct_property(class_name, JS::Value(constructor), JS::Attribute::Writable | JS::Attribute::Configurable);
-        return *constructor;
+        return Bindings::ensure_web_constructor<T>(realm(), class_name);
     }
 
     virtual JS::ThrowCompletionOr<bool> internal_set_prototype_of(JS::Object* prototype) override;
@@ -283,9 +270,6 @@ private:
 
     Bindings::LocationObject* m_location_object { nullptr };
 
-    HashMap<String, JS::Object*> m_prototypes;
-    HashMap<String, JS::NativeFunction*> m_constructors;
-
     // [[CrossOriginPropertyDescriptorMap]], https://html.spec.whatwg.org/multipage/browsers.html#crossoriginpropertydescriptormap
     CrossOriginPropertyDescriptorMap m_cross_origin_property_descriptor_map;
 };
diff --git a/Userland/Libraries/LibWeb/HTML/Worker.h b/Userland/Libraries/LibWeb/HTML/Worker.h
index d3c92d616b..f24dbe64bc 100644
--- a/Userland/Libraries/LibWeb/HTML/Worker.h
+++ b/Userland/Libraries/LibWeb/HTML/Worker.h
@@ -78,7 +78,7 @@ private:
 
     NonnullRefPtr<JS::VM> m_worker_vm;
     NonnullOwnPtr<JS::Interpreter> m_interpreter;
-    WeakPtr<WorkerEnvironmentSettingsObject> m_inner_settings;
+    JS::GCPtr<WorkerEnvironmentSettingsObject> m_inner_settings;
     JS::VM::InterpreterExecutionScope m_interpreter_scope;
     RefPtr<WorkerDebugConsoleClient> m_console;
 
diff --git a/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.cpp b/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.cpp
index 438ad3a8ab..aa7312d250 100644
--- a/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.cpp
+++ b/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.cpp
@@ -108,7 +108,7 @@ JS::Completion invoke_callback(WebIDL::CallbackType& callback, Optional<JS::Valu
     auto& realm = function_object.shape().realm();
 
     // 6. Let relevant settings be realm’s settings object.
-    auto& relevant_settings = verify_cast<HTML::EnvironmentSettingsObject>(*realm.host_defined());
+    auto& relevant_settings = Bindings::host_defined_environment_settings_object(realm);
 
     // 7. Let stored settings be value’s callback context.
     auto& stored_settings = callback.callback_context;
diff --git a/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.h b/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.h
index db0fc28ddc..c33fcdc7e3 100644
--- a/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.h
+++ b/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.h
@@ -11,6 +11,7 @@
 #include <LibJS/Forward.h>
 #include <LibJS/Runtime/AbstractOperations.h>
 #include <LibJS/Runtime/FunctionObject.h>
+#include <LibWeb/Bindings/HostDefined.h>
 #include <LibWeb/HTML/Scripting/Environments.h>
 #include <LibWeb/WebIDL/CallbackType.h>
 
@@ -60,7 +61,7 @@ JS::Completion call_user_object_operation(WebIDL::CallbackType& callback, String
     auto& realm = object.shape().realm();
 
     // 5. Let relevant settings be realm’s settings object.
-    auto& relevant_settings = verify_cast<HTML::EnvironmentSettingsObject>(*realm.host_defined());
+    auto& relevant_settings = Bindings::host_defined_environment_settings_object(realm);
 
     // 6. Let stored settings be value’s callback context.
     auto& stored_settings = callback.callback_context;
diff --git a/Userland/Services/WebContent/WebContentConsoleClient.cpp b/Userland/Services/WebContent/WebContentConsoleClient.cpp
index 6b2d96a0fa..fcff369d79 100644
--- a/Userland/Services/WebContent/WebContentConsoleClient.cpp
+++ b/Userland/Services/WebContent/WebContentConsoleClient.cpp
@@ -29,7 +29,7 @@ WebContentConsoleClient::WebContentConsoleClient(JS::Console& console, JS::Realm
     auto console_global_object = realm.heap().allocate_without_realm<ConsoleGlobalObject>(realm, window);
 
     // NOTE: We need to push an execution context here for NativeFunction::create() to succeed during global object initialization.
-    auto& eso = verify_cast<Web::HTML::EnvironmentSettingsObject>(*realm.host_defined());
+    auto& eso = Web::Bindings::host_defined_environment_settings_object(realm);
     vm.push_execution_context(eso.realm_execution_context());
     console_global_object->initialize(realm);
     vm.pop_execution_context();
@@ -42,7 +42,7 @@ void WebContentConsoleClient::handle_input(String const& js_source)
     if (!m_realm)
         return;
 
-    auto& settings = verify_cast<Web::HTML::EnvironmentSettingsObject>(*m_realm->host_defined());
+    auto& settings = Web::Bindings::host_defined_environment_settings_object(*m_realm);
     auto script = Web::HTML::ClassicScript::create("(console)", js_source, settings, settings.api_base_url());
 
     // FIXME: Add parse error printouts back once ClassicScript can report parse errors.