demo · v142

Smart-Home Device Scan

The actual attack the IETF I-D motivates: a public webpage scanning the visitor's home LAN for vulnerable cameras, printers, or routers and re-flashing them via known CVEs. Pick a scenario — a benign smart-home setup app, a vendor portal probing for the user's own kit, or a hostile ad iframe — see what Chrome 142 allows silently, what it prompts on, and what it blocks outright. The prompt below is the actual one Chrome 142 introduced.

scenario

page IP space
—
requires user prompt
—
devices found
—

simulated LAN scan results

In Chrome 142 a public page reaching private/loopback IP space triggers the new permission prompt or is blocked depending on context — even for sub-resource and WebSocket fetches. Pre-Chrome-142 this scan would complete silently.

relevant API

// Public origin trying to talk to a printer on the LAN
fetch("http://192.168.1.50:631/printers/", { mode: "no-cors" })
  // Chrome 142+: blocked unless user accepts the LNA permission prompt
  // and the printer responds with Access-Control-Allow-Private-Network: true

see also