EXPLAINER FOR LOCAL NETWORK ACCESS

Summary from the TLDR InfoSec newsletter

The Chrome Secure Web and Network team has drafted a proposal to require explicit permission for a site to access devices on the local network. This proposal seeks to address a common attack vector in which an attacker can use a CSRF vulnerability to attack a local device such as a printer. The proposal would require any request that seeks to access a more private IP space (such as public to private or private to loop back) to obtain a new “Local Network Access” permission from the user via a prompt.