0.0.0.0 DAY: EXPLOITING LOCALHOST APIS FROM THE BROWSER

Summary from the TLDR InfoSec newsletter

Security researchers discovered a new vulnerability whereby websites can bypass protections and send requests to 0.0.0.0 and reach internal APIs that are listening on localhost. This vulnerability was able to bypass Google Chrome's Private Network Access protections because 0.0.0.0 was not on the blocklist that it uses. Following the researchers' findings, all major browsers have committed to blocking requests to 0.0.0.0 and establishing Private Network Access as a standard which will include 0.0.0.0 in its blocklist.