This would be a nice ublock origin filter for Firefox Android. I installed one that blocks sites requesting localhost addresses, after I noticed some websites portscanning my localhost for "security".
Another attack vector is public DNS names that resolve to local IPs as well, like "lvh.me". I block these with a local dnsmasq instance and the "stop-dns-rebind" setting.
Still not sure if this catches everything, probably not. I really wish browsers would just block all of this by default and ask for permission.
uBO LAN list blocks those as well, only except strict 1st-party connections, i.e if `lvh.me` is used as connections on other domains (including different subdomains), it will be blocked.
That's what I was trying to get at: Are any websites using this legitimately to communicate with local applications? If so, isn't that a pretty big fingerprinting and attack vector (how are websites authenticating themselves to these local applications and vice versa)?
Edit: Also any local network equipment probably uses local ips a lot, they often have web UIs that have legitimate use cases for this.
Sure, but that trust is about me, an owner of this particular localhost, interacting with it, not trust some.website.on.web to have an unchecked communication with it.