I worked in a company that used custom DNS names to identify the environments: - www.mydomain.com - stage.mydomain.com - local.mydomain.com The last one ref

I worked in a company that used custom DNS names to identify the environments: - www.mydomain.com - stage.mydomain.com - local.mydomain.com The last one referred to the version of the app that developers ran on their own machines. So they had a DNS-level entry that sent local.mydomain.com to 127.0.0.1. This isn't a browser issue at all. I think the security issue is "applications can install local web servers" and "some local web servers are insecure". We already have XSS controls in place to prevent a domain from accessing the contents of another browser window or an iframe. It's not a browser issue. There are plenty of legitimate reasons for wanting a browser to access a local web server. It might not be common, but it's not illegitimate nor a security issue.