Bypassing a WAF and a CSP with Google Tag Manager: An Attacker’s Perspective and Remediation Advice
This blog was originally published by Ryan Chaplin on the Raxis blog February 10, 2026 During several penetration tests last year, I observed clients often set unsafe directives for Google Tag Manager usually to supplement data collection via Google Analytics and third-party vendors. Aside from the obvious problem of using unsafe directives, this threat was amplified since Google hosts malicious…
During multiple penetration tests last year, the author observed that clients often set unsafe directives for Google Tag Manager to facilitate data collection via Google Analytics and third-party vendors. This issue was exacerbated by the fact that Google hosts malicious JavaScript from googletagmanager.com. The article explores how a Content-Security-Policy (CSP) may or may not block this type of functionality.
The author highlights that a well-defined CSP can prevent reflected Cross-site Scripting (XSS) attacks by using a nonce, a server-generated random value that determines whether scripts are valid and can execute. However, implementing a CSP can be challenging due to the dynamic nature of third-party libraries and the complexities of cross-team communication and collaboration.
The strict-dynamic directive, introduced in 2021, helps address these issues by propagating trust from a trusted script to any scripts it loads. This allows organizations to implement a CSP while still supporting modern JavaScript frameworks and third-party libraries. The author provides code snippets demonstrating the implementation of a CSP with a nonce and the strict-dynamic directive, showing how malicious scripts are blocked while native features of Google Tag Manager, such as the Custom HTML Tag, can still function.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
