No, any website can detect your local IP address, then use ajax to scan a targeted IP subnet range fairly quickly (and completely hidden from the user) to find any shitty CORS-enabled web interface your company has (think some "modern" internal accounting webapp that enables CORS for its "API").

Prior to WebRTC you'd have to scan much larger IP ranges to try and find internal network webapps that are CORS enabled.

i'm more talking about being able to craft subsequent XSS requests. My browser will unwittingly be doing the attacking

My ip address is 192.168.99.105

Script tries XSS attacks on:

  http://192.168.99.1/ciscowebinterface/known_dodgy_admin?user=root&pass=NEVERCHANGED1
  http://192.168.99.1/juniper/also_leaky_admin?user=root&pass=NEVERCHANGED2
  http://192.168.99.2/... enumerated