[est31]

You're likely not even safe from this if you are using Chrome OS. It does sandbox the localhost web server [1] [2], but it does not restrict access to it from the host.

[1]: https://youtu.be/pRlh8LX4kQI?t=954

[2]: https://chromium.googlesource.com/chromiumos/platform2/+/HEA...