For reference, uBO has a filter list called "Block Outsider Intrusion into LAN" which you can enable. That blocks all cross-site requests to local IP addresses, "localhost", and some other well-known locally-resolved hostnames.

Another attack vector is public DNS names that resolve to local IPs as well, like "lvh.me". I block these with a local dnsmasq instance and the "stop-dns-rebind" setting.

Still not sure if this catches everything, probably not. I really wish browsers would just block all of this by default and ask for permission.