You can make every website in existence call eval() directly on the contents of a form field if you persuade the user to paste some arbitrary text into the deve

You can make every website in existence call eval() directly on the contents of a form field if you persuade the user to paste some arbitrary text into the developer tools. The attack here happened to involve hooking an internal helper function, but that hook was in no way necessary for the attack; it could have instead just registered for the incoming chat text event and called eval() on it there.