How to reproduce: 1. Go to the following URL: data:text/html,<!doctype><title></title><script>window.eval = function (e) { console.log('sending ' + e + ' to a malicious website!'); };</script> 2. Open the JS console. 3. Enter something. What happens: The JS console is, in this case, rendered useless because it outputs sending with ((window && window.console && window.console._commandLineAPI) || {}) { something } to a malicious website! With more malicious use of this issue, it could cause information leak from all developers on the website. What should happen: The JS console should execute the JS code entered in the console.
1) we no longer use window's eval for it. See newer Canary / nightly 2) even when we did I don't see how that could be exploited
Outstanding!