Potentially? Typically nowadays if you have some application on the host and a browser component (like a password manager) you would use a native messaging host

Potentially? Typically nowadays if you have some application on the host and a browser component (like a password manager) you would use a native messaging host and extension. There's also deep links / intents type communication. But if neither of those fit your use case I guess you would be able to have something running on localhost, maybe for something like an FTP server it would be more common. The ports that these scripts typically scan are those of known automation tools as well as malware, example is port 9222 for Chrome Devtools Protocol. Edit: Also any local network equipment probably uses local ips a lot, they often have web UIs that have legitimate use cases for this.