Exfiltrating User’s Private Data Using Google Analytics to Bypass CSP (opens in new tab)

(medium.com)

3 pointsamirshk806y ago1 comments

1 comments

1 comments · 1 top-level

tl;dr; Since a lot of websites allow google-analytics.com, 3rd party javascript code can use the fact there is no verification on the UA-ID to exfiltrate information.

j / k navigate · click thread line to collapse