v147 · stepped rollout · security · network
Local network access restrictions
Chrome 147 continues a stepped rollout of Local Network Access (LNA) restrictions, requiring user permission before public websites can send subresource requests (fetch, XHR, WebSockets, WebTransport) to local and private IP addresses. The permission model prevents drive-by attacks against routers, printers, smart home devices, and internal services on the same LAN.
at a glance
| Status in Chrome 147 | Stepped rollout (expanding to more users) |
|---|---|
| Feature rollout started | Chrome 123 (subresource fetch/XHR); Chrome 147 (WebSockets, WebTransport, Service Worker) |
| Request types covered | Fetch, XHR, WebSockets, WebTransport, WindowClient.navigate() |
| Permission mechanism | Browser permission prompt; enterprise policies for allowlists |
| Spec | WICG Local Network Access specification |
| ChromeStatus | 5152728072060928 — Local network access restrictions |
what is local network access?
LNA is a web security boundary: it prevents web pages served from public origins (e.g. https://example.com) from making requests to private/local IP addresses without the user's explicit knowledge. This matters because devices on the local network — home routers, NAS drives, printers, smart home hubs — typically have no authentication and assume incoming requests come from trusted local clients. A malicious public page that can silently fetch http://192.168.1.1/admin can attack those devices.
Chrome enforces LNA by requiring a preflight check and (when the page is not served from a secure context that is itself local) a user permission prompt before the browser sends such requests.
Source: Chrome for Developers — Local Network Accesswhat Chrome 147 adds
Chrome 147 extends LNA restrictions to three additional request types that were previously uncovered:
| Request type | Chrome 147 change | Details |
|---|---|---|
| WebSockets | Permission prompt required | WebSocket LNA page |
| WebTransport | Permission prompt required | WebTransport LNA page |
Service Worker WindowClient.navigate() | Blocked for local addresses | Service Worker LNA page |
migration
Sites affected by LNA restrictions have several options:
- Serve from a local origin: Pages served from
localhostor a private IP address are treated as local and can access other local resources without a prompt. - Use HTTPS everywhere: An HTTPS page accessing an HTTPS local endpoint over a secure connection avoids the mixed-content LNA prompt.
- Request permission explicitly: Include the
targetAddressSpace: "private"option on fetch calls to proactively request the permission before sending the request. - Enterprise allowlists: Deploy
LocalNetworkAccessAllowedForUrlspolicy to auto-grant permission for specific intranet origins.
see also
- Chrome Platform Status — Local network access restrictions
- Chrome for Developers — New permission prompt for Local Network Access
- WICG Local Network Access specification
- Local network access restrictions for WebSockets — Chrome 147
- Local network access restrictions for WebTransport — Chrome 147
- Local network access restrictions on Service Worker WindowClient.navigate() — Chrome 147