FWIW this was the status quo (webpage could ping arbitrary ports but not read data, even with CORS protections) - but it is changing. This is partially in resp

FWIW this was the status quo (webpage could ping arbitrary ports but not read data, even with CORS protections) - but it is changing. This is partially in response to https://localmess.github.io/ https://localmess.github.io/ where Meta and Yandex pixel JS in websites would ping a localhost server run by their Android apps as a workaround to third-party cookie limits. Chrome 142 launched a permission dialog: https://developer.chrome.com/blog/local-network-access https://developer.chrome.com/blog/local-network-access Edge 140 followed suit: https://support.microsoft.com/en-us/topic/control-a-website-s-access-to-the-local-network-in-microsoft-edge-ef7eff4c-676d-4105-935c-2acbcd841d51 https://support.microsoft.com/en-us/topic/control-a-website-... And Firefox is in progress as well, though I couldn't find a clear announcement about rollout status: https://fosdem.org/2026/schedule/event/QCSKWL-firefox-local-network-access/ https://fosdem.org/2026/schedule/event/QCSKWL-firefox-local-... So things are getting better! But there was a scarily long time where a rogue JS script could try to blindly poke at localhost servers with crafty payloads, hoping to find a common vulnerability and gain RCE or trigger exfiltration of data via other channels. I wouldn't be surprised if this had been used in the wild.