-
Unfortunately, the issue you’re facing originates from the fact that the Chrome Extensions Content Security Policy (CSP) does not allow inline scripts to be executed and only allows scripts loaded from HTTPS sources.
However, one does not have the authority to alter this policy.Therefore, you would need to pull in the GA4 script and host it locally within your extension. Then, you’d have to include it from your manifest.json file and access it as ‘self’.
Moreover, Google Analytics (GA) also utilizes inline scripts, which is another no-go as per the security policies of Chrome Extensions. Thus, you will need to modify the GA script to allow the creation of script tags dynamically or find another way to execute your GA tracking.
It could be that little bit easier if you made use of the chrome.tabs.executeScript API to inject your GA code into the context of web pages loaded in your user’s browser. Alternatively, you could also look at using an analytics service that offers a library specifically designed for browser extensions, such as the Beacon API.
Remember, when modifying the CSP, be utterly sure that it does not expose your extension to the risk of XSS attacks.
