It is done by the extension without any fancy stuff. Extensions can load static js / css and bypass CSP with it, if it is declared in their manifest.json. Gramm

It is done by the extension without any fancy stuff. Extensions can load static js / css and bypass CSP with it, if it is declared in their manifest.json. Grammarly's manifest.json is here: https://gist.github.com/Daquisu/11eb1a7000b4141c4404edcc6e16b666 https://gist.github.com/Daquisu/11eb1a7000b4141c4404edcc6e16... For more advanced CSP bypass with extension, you can: 1. Inject JS code into any webpage with a CSP. 2. Create an event listener for your content script and reacting according to it. 3. Use your content script to communicate with the background script. 4. Use the background script to communicate with any website, including blocked websites by the CSP. Basically, any website <-> extension content script <-> background script <-> any website.