[fjni]

Wouldn't you be able to deploy an app script website, which is hosted on "script.google.com" and make use of this?

[jhdifdhsak]

your code do not run from that domain at all.

[rc_mob]

it does if I hack your dns server :)

[pixl97]

Does Chrome do certificate pinning checking in this case?

[gnaman]

No it does not. Firefox does by default. But then again, you would need the user to install your cert. Good luck with that