yeah, it does eval(); no vuln, just a specific design choice that breaks the security model of the browser plugins. Basically the plugin operates at a higher l

yeah, it does eval(); no vuln, just a specific design choice that breaks the security model of the browser plugins. Basically the plugin operates at a higher level than the regular page DOM, so by running angular from a plugin you gain the ability to both execute (arbitrary) javascript from the page but also read/write to the disk. very bad. cannot be fixed. arbitrary code execution by design.