diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4b4b82944999..9918c20e24e3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@
 - Handling `@@toPrimitive` in some cases of `ToPrimitive` internal logic made stricter
 - Fixed work of `Request` with polyfilled `URLSearchParams`, [#965](https://github.com/zloirock/core-js/issues/965)
 - Fixed possible exposing of collections elements metadata in some cases, [#427](https://github.com/zloirock/core-js/issues/427)
+- Fixed crashing of `Object.create(null)` on WSH, [#966](https://github.com/zloirock/core-js/issues/966)
 - Fixed some cases of typed arrays subclassing logic
 - Fixed a minor bug related to string conversion in `RegExp#exec`
 - Fixed `Date.prototype.getYear` feature detection and compat data for IE8-
diff --git a/packages/core-js/internals/object-create.js b/packages/core-js/internals/object-create.js
index 81a7e7b34108..fff3ac66d270 100644
--- a/packages/core-js/internals/object-create.js
+++ b/packages/core-js/internals/object-create.js
@@ -1,3 +1,4 @@
+/* global ActiveXObject -- old IE, WSH */
 var anObject = require('../internals/an-object');
 var defineProperties = require('../internals/object-define-properties');
 var enumBugKeys = require('../internals/enum-bug-keys');
@@ -42,14 +43,8 @@ var NullProtoObjectViaIFrame = function () {
     iframeDocument.open();
     iframeDocument.write(scriptTag('document.F=Object'));
     iframeDocument.close();
-  } else {
-    /* global ActiveXObject -- in WSH */
-    activeXDocument = new ActiveXObject('htmlfile');  // without document.domain
-    iframeDocument = {
-      F: NullProtoObjectViaActiveX(activeXDocument)
-    };
+    return iframeDocument.F;
   }
-  return iframeDocument.F;
 };
 
 // Check for document.domain and active x support
@@ -60,10 +55,12 @@ var NullProtoObjectViaIFrame = function () {
 var activeXDocument;
 var NullProtoObject = function () {
   try {
-    /* global ActiveXObject -- old IE */
-    activeXDocument = document.domain && new ActiveXObject('htmlfile');
+    activeXDocument = new ActiveXObject('htmlfile');
   } catch (error) { /* ignore */ }
-  NullProtoObject = activeXDocument ? NullProtoObjectViaActiveX(activeXDocument) : NullProtoObjectViaIFrame();
+  NullProtoObject = document.domain && activeXDocument ?
+    NullProtoObjectViaActiveX(activeXDocument) : // old IE
+    NullProtoObjectViaIFrame() ||
+    NullProtoObjectViaActiveX(activeXDocument); // WSH
   var length = enumBugKeys.length;
   while (length--) delete NullProtoObject[PROTOTYPE][enumBugKeys[length]];
   return NullProtoObject();