Browsers have debuggers, which allow users to set breakpoints and inject/run arbitrary code in the context of some function. (At least Chrome allows that, not sure about others.)