v138 · security

Local network access restrictions

Chrome 142 restricted the ability to make requests to the user's local network, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, or from a local website (for example, intranet) to loopback.

concepts

  1. LNA Prompt

    Local Network Access permission gates public-origin requests to private/loopback addresses.

  2. Router-attack walkthrough

    The CVE class this feature kills, step by step: a public attacker page firing fetch() at 192.168.1.1/admin/dns. Pre-138 vs 138 side by side.

  3. Permission flow simulator

    Pick a source and destination across public, private, and local address spaces. See the computed CORS preflight, the verdict (allowed / prompt / blocked), and the full address-space matrix.

  4. Preflight Inspector

    Type any IP address or hostname to classify it as public, private, or loopback — and preview the exact Access-Control-Request-Private-Network preflight exchange Chrome requires before allowing the request.

why it shipped

Currently public websites can probe a user's local network, perform CSRF attacks against vulnerable local devices, and generally abuse the user's browser as a "confused deputy" that has access inside the user's local network or software on their local machine. Gating the ability for sites to make local network requests behind a permission prompt helps stop the exploitation of vulnerable devices and servers from the drive-by-web, and gives users control over which sites can probe their local network.

references