This jumped out at me too, very clever. I imagine that localhost isn't treated any differently to any other domain which might have CORS enabled. Unclear what t

This jumped out at me too, very clever. I imagine that localhost isn't treated any differently to any other domain which might have CORS enabled. Unclear what the correct solution is, though. EDIT: Gaming this out a little bit, another interesting application of this technique could be to create a fairly accurate map of a Windows-centric private network. Example: Start with a bunch of known private network IP spaces, scan through as many IPs as possible, report back addresses that have open/closed/filtered ports.