v145 · Security · Fetch · demo
CSRF Scenario
Step through three scenarios: a CSRF attack against a home router without LNA restrictions, the same attack blocked by Chrome 145 LNA restrictions, and a legitimate developer tool that opts in via targetAddressSpace. See which requests Chrome allows, prompts, or silently blocks.
Chrome 145: any request from a public-origin page to a private IP address (192.168.x.x, 10.x.x.x) or loopback (127.0.0.1) now triggers an LNA permission prompt. The pre-Chrome 145 CSRF attack surface against home routers is closed by default.
Pick a scenario · click "Run scenario" · watch the request flow step by step
Attacker's page
https://evil.example.com
—
Chrome Browser
LNA enforcement point
—
Home Router
http://192.168.1.1/admin
—
// Chrome 145 — LNA for legitimate local-network fetch:
// 1. Declare targetAddressSpace
// 2. Server must respond with Access-Control-Allow-Private-Network: true
const res = await fetch('http://localhost:3000/api/status', {
targetAddressSpace: 'loopback', // 'loopback' | 'private' | 'local'
mode: 'cors',
credentials: 'omit', // avoid leaking cookies to local services
});
// CSRF attacks can NOT use this opt-in:
// - attacker.example is a public origin
// - The browser would show a permission prompt
// - A prompt for "evil.example wants to access your router" → user denies
// - Or Chrome silently blocks without prompt for certain cases