Permission Policy Merger: direct-sockets-private with local-network and loopback-network

at a glance

Implementation-status divergence, both sides reported rather than resolved (fetched 2026-10-07): this page records the granular policies shipping in Chrome 151 for Isolated Web Apps, while the ChromeStatus API record top-level status string still reads “Proposed” (accurate_as_of 2026-06-22) even though stage 160 explicitly sets desktop_first: 151.

why it exists

The Direct Sockets API gives Isolated Web Apps raw TCP/UDP socket access. Previously, accessing private network addresses (LAN and loopback) required declaring a single coarse direct-sockets-private permission policy in the IWA manifest. This all-or-nothing approach made it impossible to grant an IWA LAN access without also granting loopback access (or vice versa).

In accordance with the principle of least privilege and Private Network Access specifications (WICG PNA), separating these scopes ensures that an app intended to communicate with LAN hardware (like printers or IoT devices) cannot inadvertently or maliciously access sensitive local machine daemons listening on 127.0.0.1.

permissions policy syntax and manifest fields

Per the W3C Permissions Policy specification and MDN Permissions Policy reference, policies are declared in the Web App Manifest permissions_policy field for IWAs:

"permissions_policy": {
  "local-network": ["self"],
  "loopback-network": ["self"]
}

Attempting to open a TCPSocket or UDPSocket to a destination address without the necessary policy declared in the manifest causes the connection promise to reject with a DOMException (e.g. SecurityError or NetworkError).

examples

In Chrome 151+, Isolated Web Apps must declare the exact network scope in their manifest file:

// IWA Web App Manifest (Chrome 151+ — granular control)
{
  "name": "Local Network Device Manager",
  "start_url": "/",
  "display": "standalone",
  "permissions_policy": {
    "local-network": ["self"],      // allow LAN connections
    "loopback-network": ["self"]    // allow loopback connections
  }
}

// Or just local-network, if the app only connects to LAN devices:
{
  "name": "LAN Printer Controller",
  "permissions_policy": {
    "local-network": ["self"]
  }
}

browser support

see also

• Chrome Platform Status — Permission Policy Merger: direct-sockets-private
• ChromeStatus API record (6046077976444928)
• ChromeStatus milestone 151 features query
• WICG Direct Sockets specification — Permissions Policy PNA
• WICG Direct Sockets specification
• Direct Sockets explainer
• WICG Isolated Web Apps repository
• W3C Permissions Policy specification
• MDN: Permissions-Policy HTTP header
• WICG Private Network Access specification
• WICG Private Network Access repository