So any website can make arbitrary requests to localhost or any internal LAN server? You could have a field day with just a little bit of internal knowledge on that one.
Do random malicious web pages in IOS still have the ability to open the app store too? Was that the genesis of all this nonsense, just trying to make the app store easier?
Several russian sports sites scan your local network for several UDP and TCP ports, which I block via my firewall. Chrome should be blocked to access 192.168.. for all TCP and UDP ports. localhost of course also.