v142 · security

Local network access restrictions

Chrome 142 restricted the ability to make requests to the user's local network, gated behind a permission prompt. A local network request is any request from a public website to a local IP address or loopback, or from a local website (for example, intranet) to loopback.

concepts

  1. LNA Prompt

    Type an initiator and a target URL, see the IP-space classification, and watch Chrome 142 decide allow / prompt / block. Press try fetch to actually attempt the request.

  2. Smart-Home Device Scan

    The actual attack the IETF I-D motivates: a webpage scanning the visitor's LAN for cameras, printers, and routers. Three scenarios — benign setup app, vendor portal, hostile ad iframe — show what Chrome 142 prompts on vs blocks outright.

  3. Preflight Header Inspector

    Step the CORS-PNA negotiation. Pick initiator/target IP spaces, toggle Access-Control-Allow-Private-Network, and set the user's permission state — see exactly which message gets dropped, which header is missing, and whether the verdict is allow / prompt / block.

  4. LNA Compliance Checker

    Paste JavaScript fetch/XHR code and click "Check" — the tool scans for private IP patterns (192.168.x, 10.x, 127.x, localhost) and flags each one with a preflight requirement checklist. "Generate fix" produces a Node.js middleware snippet with the correct Access-Control-Allow-Private-Network header per target.

why it shipped

Currently public websites can probe a user's local network, perform CSRF attacks against vulnerable local devices, and generally abuse the user's browser as a "confused deputy" that has access inside the user's local network or software on their local machine. Gating the ability for sites to make local network requests behind a permission prompt helps stop the exploitation of vulnerable devices and servers from the drive-by-web, and gives users control over which sites can probe their local network.

references