The difference is that file:// URLs can be opened by your grandparent opening a .html file that they downloaded, whereas http://localhost http://localhost requi

The difference is that file:// URLs can be opened by your grandparent opening a .html file that they downloaded, whereas http://localhost http://localhost requires you to actually set up a web server. Imagine double-clicking a malicious page.html and suddenly your entire Documents folder can be fetched and manipulated by JavaScript. Yikes. But to your latter point, yeah, there’s no reason sandboxed web apps couldn’t be given better file:// permissions.