0.0.0.0 Day: Exploiting Localhost APIs from the Browser

It's a slightly tangential title (it's a shame the convo ended up attached to that vs one of the oligo|appsecvillage submissions)