v146 · security

Local network access restrictions

Requests from public sites to local IP addresses (and from local sites to loopback) now require a permission prompt. Mitigates cross-site request forgery attacks against intranet routers, IoT devices, and dev servers running on the user's machine.

concepts

  1. Request Classifier

    Type a target URL and see whether Chrome would classify the resulting request as "local network access" and gate it behind a prompt. Helpful for dev teams instrumenting their own deployments.

  2. CSRF Attack Simulator

    The drive-by router takeover, step by step. Flip restrictions ON and OFF to see exactly where the new permission check severs the attack chain — and read why the spec splits local-network from loopback-network.

  3. Preflight inspector

    Pick an initiator / target / response shape and replay the full PNA decision: address-space classification, preflight, headers and verdict. The tool you reach for when a prod fetch starts failing.

  4. Permission prompt walkthrough

    Even with a clean preflight the first cross-space request triggers a prompt. Walk first-time, stored-allow, stored-block and missing-preflight scenarios with a faux Chrome chrome.

why it shipped

The classic CSRF attack against a home router goes: visit attacker.example, attacker.example fetches http://192.168.1.1/admin?action=... via your browser, your browser sends your authenticated session cookies along, the router does what the attacker asked. The local network access restriction puts a permission prompt between any public-origin page and any private-IP target. Routers and devices that explicitly opt in via CORS preflights keep working; the bulk of attack surface goes away.

references