Hacker News Reader

The browser could refuse to connect to localhost. I think there are browsers that refuse (i.e. to prevent attacking a router config interface).

I doubt anyone is running a browser on their router.

But still, you could do the same for stun, turn, sdp. Disallow local host.

That's literally what browsers have done (for STUN) and are working on (for TURN).