VulnSocial

CVE-2024-9966General(google / chrome)

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

google CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • chrome

Threat summary

  • Public PoC is present in monitored signal
  • 2 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
google
Products
chrome

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-02: 2PoC Mentioned / Linked · 2026-09-02: 1Technical Details · 2026-09-02: 109-02
Signal classification2 categories
General
150.0%
PoC
150.0%
Referenced assets1 URL
By indicator
Full discourse2 posts
  • Intigriti@intigriti
    PoC

    Our third write-up winner is fir3cr4ckers! 🎊 fir3cr4ckers took a completely different approach to solving the challenge, using CVE-2024-9966, a Chrome session-history bug, to strip the inherited CSP from a srcdoc iframe instead of relying on the JSONP gadget most others used. The write-up also references a similar technique from idekCTF 2024, which was cool to see! 😎 Read it here 👇 https://www.fir3cr4ckers.xyz/blog/2026/intigriti-august-2026-bad-reception

    Post summary

    The write-up demonstrates a proof of concept using the Chrome session-history bug (CVE‑2024‑9966) to bypass CSP in a CTF challenge, with details available in a linked blog post but no evidence of active exploitation, patches, or false positives.

    10052388
    216.0K followersView on X
  • psytester@psytester1
    General

    @intigriti ohh 😍 with chrome I was not that wrong, but I did not find a write up for CVE-2024-9966 in ctf context

    Post summary

    The tweet mentions CVE‑2024‑9966 but provides no technical details, PoC, exploit, patch, or evidence of exploitation.

    00012153
    103 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgooglechrome---

Explore more

Back to dashboardgoogle CVEschrome vulnerabilities