There are two things that play a part - first Google must be able to load additional tracking code, then it must be able to send information off to the Google Server.
The first part requires the Google Analytics snippet that you have to embed into your page. This code executes a header injection, i.e. it adds dynamically a script tag to the header of your page. This is per se not a security issue since you have inserted the necessary code yourself (however some people seem unaware that they have handed to keys to their website to Google). Since the script runs in the context of the page it can perform all kind of actions like setting and reading first party cookies.