Are you running PiHole, Adguard or similar and using macOS? On macOS, Chrome treats 0.0.0.0 as a local address which results in these prompts. Switching to having blocked domains return NXDOMAIN can work around the issue.

Thanks! Could be AdGuard!

I would note that if you say no to this, not only automatic but also explicit top-level navigation to “local network” locations (e.g. localhost, 192.168.1.x, etc) will be denied. Kind of annoying when you don’t want Chrome exploring your network, yet still need to regularly e.g. access your NAS web dashboard.

Any chance it was a macOS prompt? Chrome needs local network permissions for WebRTC, Cast etc. even without any website accessing your local network.

It is most likely this: https://wicg.github.io/local-network-access/

For a while there's been an anti-pattern where a piece of software leaves a localhost daemon running (often without proper security) for web integration.

One of the more famous abusers was Zoom: https://infosecwriteups.com/zoom-zero-day-4-million-webcams-...

XSRF vulns also have existed where e.g. a web page can blinding attempt to hit your router's page to change your DNS servers by knowing common router admin sites and default home network topologies. This isn't as useful in today's HTTPS world.

Browsers have been adding more partitioning between local and internet resources to prevent this sort of thing. But that does mean simply putting localhost entries in a hosts file to blackhole a site can now cause an issue.

Chrome says "this site", no? Isn't it the tab you have in focus?

I wonder what kind of person says 'Yes' to this prompt. It gives me the heebie jeebies.

3D mice and other hardware may run a local server for web applications to use them as input methods. The dialog can also show up if you are using network security software which proxies requests via private IP address range. Plenty of other non-nefarious reasons too...

Safari and Firefox allow this by default without a prompt or visible indicator (but maybe that has changed now that Chrome added its dialog).

No, it’s a macOS level prompt.

Then it’s most likely Chrome using local network access for WebRTC or Chrome without granting that access to websites without any explicit interaction with camera permissions or cast features.

pretty sure it is a way of fingerprinting your machine/network

Let's hope it's as simple as that and not a malvertising campaign.

ebay does this i think, someone else linked a post about port scanning

I had this and it turned out to be my unifi firewall block triggering a false-positive in the browser.

usually its scanning for chromecasts on the local network, but could be other things as well

Yeah, that’s always an automatic nope. No explanation of who/what is really asking or why so, no: your shit software or website can’t go snooping around on whatever network I happen to be on, whether that’s at home or at work.

Something in my work's SSO / auth mechanism does this and if you click No it silently screws up the internal website you're visiting. It doesn't block you from logging in, just parts of the site don't load/work. I haven't been able to get a good answer on what the heck is going on but it's extremely annoying.