Even if patched/depracated, still a websocket to any ip-address with the packets as long as it can send the packet. Literally any chat applet.

Torrent files, pretty much anything. It's not that scary at the moment.

Browsers can do it now. It's an age old 'feature' -> https://github.com/garywill/LAN-port-scan-forbidder

uBlock apparently blocks your browser from reaching out to your LAN though, but; no 'sandbox escapes' needed, just javascript being loaded.

Our browsers could have been exploiting things behind NAT this entire time. Smart TVs, Smart watches, phones, anything pingable on your LAN.

Go here and see it in action: http://samy.pl/webscan/