Google Tag Manager (GTM) does not inherently bypass a properly configured Content Security Policy (CSP) or Web Application Firewall (WAF). In the attack chain described by security firm Raxis, an existing cross-site scripting (XSS) flaw lets attacker-controlled input run in a page; a permissive CSP allows the script-loading path; and a browser then executes code delivered through an attacker-controlled GTM container. A WAF may miss later browser-side behavior if it only inspects the original request. The root problem is unsafe input reaching executable page context, compounded by policy and tag-management weaknesses—not a standalone GTM vulnerability.
What the reported attack actually depends on
Ryan Chaplin’s Raxis case study, first published February 10, 2026 and updated June 3, 2026, describes a specific demonstration—not a universal result for every WAF, browser, or CSP configuration. Its vulnerable application reflects a URL parameter into a page without adequate sanitization or output encoding. The demonstrated chain depends on three conditions:
As an Amazon Associate I earn from qualifying purchases.
- An injection flaw: Untrusted input can become executable markup or script in the page, as with reflected or stored XSS.
- A permissive CSP: The policy allows the relevant script execution or loading route and does not require an appropriate per-response nonce for the GTM snippet.
- An attacker-controlled GTM container: The page can load that container, whose configured tags can provide code to run in visitors’ browsers.
In the case study, injected markup causes the browser to load gtm.js using an attacker-controlled container ID. The browser then executes the resulting code in the vulnerable site’s page context. GTM is acting as a script-delivery route that the page’s policy already permits; it is not overriding a strict CSP. Stored XSS could make the injection persistent, and a container’s tags could be changed later, but those are possible impacts of that scenario rather than properties of GTM itself.
Chaplin reports submitting parts of his GTM research to Google’s bug bounty program and receiving an honorable mention. That is the author’s account; it does not establish that Google classified GTM as a product vulnerability.
#1 Best Overall
Why a WAF may not stop browser-side behavior
A WAF evaluates traffic at the network or application boundary, typically before the response reaches the browser. It can block suspicious requests and is valuable defense in depth. But a rule that looks for a particular string in a URL parameter cannot, by itself, prove that scripts the browser fetches later are safe.
In the Raxis example, the initial request can trigger a script-loading path, while code fetched afterward from the GTM container performs the later behavior. The case study reports a Cloudflare demonstration and discusses deny-list rules; that finding is specific to the tested setup and should not be generalized to every Cloudflare plan, current rule set, or other WAF. WAF rules may reduce exploitability, but they do not repair an output-encoding defect or make a permissive CSP strict.
Rank #2
How to secure the application, CSP, and GTM
1. Fix the injection flaw first
Encode untrusted values for the exact output context in which they appear, and avoid building executable markup from user-controlled data. Validate inputs where appropriate, but do not treat validation as a substitute for context-aware output encoding. CSP and WAF rules are additional safeguards, not replacements for safe application behavior.
The W3C’s CSP Level 3 page describes CSP as defense in depth, and OWASP’s Content Security Policy Cheat Sheet cautions that CSP should not be the only defense against XSS. The W3C page is a Working Draft, not a finalized Recommendation.
2. Use a strict CSP with a per-response nonce or a hash
Google’s Tag Manager CSP documentation recommends generating an unpredictable nonce individually for each response, placing it in the CSP header and on the nonce-aware inline GTM container snippet. GTM propagates that nonce to scripts it adds. A hash can be another option for stable inline code, but it is less suited to inline content that changes frequently.
In practical terms, a nonce generally fits pages whose inline script is rendered dynamically by the server; a hash fits inline code that remains stable enough to calculate and maintain a matching value. Choose the approach that matches how the application generates pages, and make sure the policy and markup agree for each response. Google also notes that some tags need additional source directives, so test the actual tags and destinations in use rather than copying a broad host list from an example.
Rank #4
3. Avoid broad unsafe directives
Google says, “The use of ‘unsafe-inline’ is discouraged.” Avoid adding it just to make GTM work if a nonce- or hash-based policy can support the required scripts.
Google also says that GTM Custom JavaScript variables evaluate as undefined under CSP unless unsafe-eval is enabled. Its guidance is: “Custom Templates are the recommended alternative to Custom JavaScript variables.” Prefer Custom Templates where feasible rather than weakening the policy solely for convenience.
4. Treat GTM publishing access as production-code access
Configured tags execute in visitors’ browsers, so the ability to publish container changes has meaningful security consequences. Limit publishing permissions to people who need them, review tags and triggers, and remove unused configurations. Check the current Google account and container controls for the specific authorization options available to your organization; those controls can change over time.
5. Observe policy violations and test before enforcement
OWASP describes Content-Security-Policy-Report-Only as a way to collect policy violation reports without enforcing the policy. Use a report-only rollout to identify legitimate blocked resources, then build and enforce the narrow policy the site actually needs. Google recommends CSP violation reporting and provides Tag Assistant to help identify blocked resources.
Test business-critical GTM features against the intended policy, including preview and debugging workflows. Google’s guide notes that GTM Preview Mode has specific host and style, font, and image requirements. Analytics, Ads, Floodlight, and other features can have different network needs; permit only the sources required by the features actually deployed.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. Keep WAF rules as a supplementary control
Review the deployed WAF’s managed and custom rules, and test them against the application with authorization. Check the final request and response as well as browser behavior; a request that appears harmless to one rule may still lead to an unsafe script execution path. After correcting application output and CSP, retest the relevant flows. A deny-list rule is not a fix for the underlying XSS flaw.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to take from the case study
- The attack chain requires an injection weakness; GTM is an enabling script host in the described scenario, not the initial vulnerability.
- The demonstration depends on a permissive CSP arrangement and a container the attacker can control.
- A WAF can help block hostile requests, but request inspection alone may not control what an allowed script does later in a browser.
- Per-response nonces or hashes can support a stricter CSP; Google’s nonce-aware GTM snippet propagates its nonce to added scripts.
- Use
unsafe-inlineandunsafe-evalonly when there is a justified need and no safer practical alternative.
Google’s CSP Evaluator can help identify potential weaknesses and subtle bypasses in a policy. Google describes it as a convenience tool and provides no guarantee that a policy it checks is safe. Treat it as one input to review, not as certification.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
