This paper presents a newlocalhost browser based vulnerability and corresponding attack that opens the door to new attacks on private networks and local devices. We show that this new ulnerability may put hundreds of millions of internet users and their IoT devices at risk. We demonstrate the viability of the attack on a real product, “Folding@Home”, of which we did a responsible disclosure of the specific vulnerability . Following the attack presentation, we
suggest three new protection mechanisms to mitigate this vulnerability, across the different
entities of the attack (broswer, localhost server, and attacked IOT). This new attack bypasses recently suggested protection mechanisms designed to stop browser-based attacks on private devices and local applications (Chromium and Rigoudy 2021, Afek et al. 2019), of which
we also did a responsible disclosure.