One can always use both eval() and new Function() in packaged apps, but that requires adding the line

    "content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"

to the app manifest, according to the chrome web page. I don't know for sure, but I assume it will just be shown as an extra item in the install dialog of a packaged app for the user (?).