Et Tu, Grammarly?

Do you know how they managed to inject stylesheets into every page bypassing CSP?

It is done by the extension without any fancy stuff. Extensions can load static js / css and bypass CSP with it, if it is declared in their manifest.json. Grammarly's manifest.json is here: https://gist.github.com/Daquisu/11eb1a7000b4141c4404edcc6e16...

For more advanced CSP bypass with extension, you can:

1. Inject JS code into any webpage with a CSP.

2. Create an event listener for your content script and reacting according to it.

3. Use your content script to communicate with the background script.

4. Use the background script to communicate with any website, including blocked websites by the CSP.

Basically, any website <-> extension content script <-> background script <-> any website.