v141 · security

Local network access restrictions

Chrome 142 restricted the ability to make requests to the user's local network, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, or from a local website (for example, intranet) to loopback.

concepts

  1. LNA Prompt

    Local Network Access prompts gate public-origin requests to private/loopback addresses. Mitigates the router-CSRF attack class.

  2. Router CSRF Attempt

    The motivating attack — public site fires at 192.168.x.1 admin endpoints. Click any target and watch the prompt or failure mode appear in real time.

  3. IoT Discovery

    The fingerprinting variant — scan a /29 subnet or common loopback ports. Pre-141 this leaked a uniqueness oracle for any household; 141 returns identical failures for every probe.

  4. Network Topology Explorer

    Enter any IP or hostname and see its classified address space (public, private, loopback, link-local). A second panel lists the CORS preflight headers a local server must return — Access-Control-Allow-Private-Network and friends — to satisfy the LNA check.

why it shipped

Currently public websites can probe a user's local network, perform CSRF attacks against vulnerable local devices, and generally abuse the user's browser as a "confused deputy" that has access inside the user's local network or software on their local machine. Gating the ability for sites to make local network requests behind a permission prompt helps stop the exploitation of vulnerable devices and servers from the drive-by-web, and gives users control over which sites can probe their local network.

references