fix: remove unsafe eval() in extensions.js

[orbisai0security]

Summary

Fix critical severity security issue in packages/debugger-frontend/dist/third-party/front_end/models/extensions/extensions.js.

Vulnerability

Field	Value
ID	V-002
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-002
File	packages/debugger-frontend/dist/third-party/front_end/models/extensions/extensions.js:1

Description: The ExtensionServer.evaluate() method executes arbitrary JavaScript expressions in the context of the inspected web page via the Chrome DevTools Protocol. The only permission check is extensionAllowedOnURL(), which validates the target URL against the extension's declared hostsPolicy. An extension registered with '<all_urls>' in runtimeAllowedHosts satisfies this check for any URL, enabling unrestricted JavaScript execution in any inspected page. No user confirmation is required, and no sandboxing limits the scope of the executed code.

Changes

• packages/debugger-frontend/dist/third-party/front_end/models/extensions/extensions.js

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[github-actions]

Warning

Missing Test Plan

Please add a "## Test Plan" section to your PR description. A Test Plan lets us know how these changes were tested.

Caution

Missing Changelog

Please add a Changelog to your PR description. See Changelog format