[scrollaway]

Hard to call it a flaw... it's definitely problematic, but it's seen legitimate uses in many web apps (Spotify, Discord to think of two) as a way to communicate with their own desktop client from the web.

The other related issue is that communicating with localhost over https is very hard for an app. I wonder if there is a potential way to kill two birds with one stone here with some browser changes.