Bypassing a WAF and a CSP with Google Tag Manager: An Attacker’s Perspective and Remediation Advice

This blog was originally published by Ryan Chaplin on the Raxis blog February 10, 2026 During several penetration tests last year, I observed clients often set unsafe directives for Google Tag Manager usually to supplement data collection via Google Analytics and third-party vendors. Aside from the obvious problem of using unsafe directives, this... Weiterlesen