v142 · security

Local network access restrictions for WebSockets

Local Network Access(LNA) restrictions are being expanded to include WebSockets. WebSockets connections to local address will now start triggering permission prompts.

concepts

  1. WebSocket LNA

    Type a ws:// URL, see the IP-space classification and Chrome 142 outcome, and actually attempt the connect to see what happens.

  2. Vite-Style Dev Server HMR

    The friction this change caused for web devs: every framework's HMR WebSocket points at ws://localhost. Tunnel preview, local dev, and hostile iframe scenarios with a real WebSocket attempt and a verdict per case.

  3. IoT Fleet Browser

    Six real LAN devices — printer JSON-RPC, NAS web UI, smart-bulb hub, router admin, Vite HMR, cloud-tunnelled hub. Click each to see Chrome 142's verdict, the WebSocket handshake trace, the developer remediation, and attempt the real connection from this public origin.

  4. WebSocket Upgrade Tester

    Three target cards — loopback, private LAN, public WSS — each with a "Test" button. A Chrome 141/142 enforcement mode toggle shows the difference between warning and blocking. An animated LNA preflight timeline and a table of required HTTP 101 response headers help server authors get compliant.

why it shipped

Local WebSockets connections are subject to many of the same attacks that the original LNA proposal are designed to solve.

references