Content-Security-Policy: script-src 'none'

URL: https://not-just-another-xss.chall.lab.ctbb.show/

Get Cross-Site Scripting (XSS) to pop an alert(origin) on this page, working on Chrome. That’s it, good luck.
Oh, and before you go spin up your recon pipeline, please don’t because fuzzing is not needed.

Try not to share solutions too publicly. A writeup follows this post soon.