# Firefox 154 Locks Down WebSocket Access to Your Local Network

Page: https://hirantha.me/blog/firefox-154-locks-down-websocket-access-to-your-local-network
Published: 2026-08-19
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: firefox, web security, websocket, browser privacy, local network access

> Firefox 154 now prompts for permission before a website's WebSocket can reach your router, printer or local dev server.

## The gap that just closed

Firefox 154, released on August 18, 2026, extends Mozilla's Local Network Access protections to cover WebSocket connections. In Mozilla's own words: "Firefox's Local Network Access protections now extend to WebSocket connections. Websites that try to open a WebSocket to a device on the local network will now ask for permission first."

That sounds narrow, but it closes a real hole. Local Network Access (LNA) already governed regular fetch requests, images and scripts, subframe navigation, service workers, WebRTC, and WebTransport. A page could not silently poke your router over a normal HTTP (Hypertext Transfer Protocol) request. But a WebSocket handshake was a separate code path, and it was not covered, so a malicious or compromised script could still open a raw socket to a device on your network without triggering any prompt at all.

## Why this class of protection exists

Browsers group network destinations into three categories: public addresses (anything reachable from the open internet), local addresses (private ranges like 192.168.0.1, reachable only on your network), and loopback addresses (127.0.0.1, reachable only from your own machine). The risk LNA defends against is a public web page reaching down into the local or loopback range, where it can find routers, printers, smart TVs, and other devices that were built assuming only trusted traffic from inside the network would ever reach them.

The textbook version of this attack has a malicious site's JavaScript quietly try common router login pages and change the router's Domain Name System (DNS) settings if it gets in, redirecting the victim's future traffic to phishing sites without ever touching their computer directly. Plenty of IoT devices and local dashboards carry the same assumption of trust, and a WebSocket connection could reach them just as easily as a fetch call, just without the prompt.

## How the prompt works

When a page from the public internet tries to open a WebSocket to a local or loopback address, Firefox now shows a permission prompt asking whether to allow it, the same pattern already used for other LNA-covered requests. Users can choose to have Firefox remember that decision for future visits to the same site. Firefox also exposes enterprise policies so organizations can pre-approve or block specific URLs, or control the prompting behavior fleet-wide, rather than leaving the decision to individual users.

## Chrome is closing the same gap

This is not a Firefox-only change. Chromium's own Local Network Access restrictions for WebSockets have been in developer testing since Chrome 142, are rolling out to half of Beta users, and are targeted for a default-on rollout in Chrome 147, complete with a kill switch in case it breaks sites in the wild. Once that lands, the two largest browser engines will both be prompting before a page can quietly reach into a private network over a WebSocket, making this a platform norm rather than a single vendor's policy.

## Other changes in this release

The rest of Firefox 154 is smaller. Smart Window can now suggest and name groups of related tabs as part of a gradual rollout. Local profile backups, previously available on Windows and Linux, now work on macOS too, and can be restored across all three platforms. The address bar gained a "Manage AI" quick action that opens Firefox's artificial intelligence (AI) settings directly. On the developer side, the release adds Cascading Style Sheets (CSS) `sibling-count()` and `sibling-index()` functions, the `text-box-trim` and `text-box-edge` properties, several new `Iterator.prototype` methods, and a round of WebDriver BiDi additions including screencast recording commands.

## What it means in practice

For most people browsing normally, this shows up as an occasional new permission prompt and nothing else. For developers, the thing worth testing now is any pattern where a page hosted on the public internet opens a WebSocket back to a local Internet Protocol (IP) address or to localhost, such as a router or IoT configuration dashboard served from a vendor's cloud site, or a debugging tool that connects from a hosted page to a socket running on the visitor's machine. Same-origin local development, where you load a page directly from localhost and it opens a WebSocket back to that same localhost server, is not the pattern this targets and should keep working as before.

Given that Chrome is rolling out the identical restriction on a similar timeline, this is worth fixing once rather than patching separately for each browser as complaints come in. If your product relies on a public page reaching a local device over a WebSocket, plan for a permission prompt, and make sure your onboarding explains why the browser is asking.

## Questions

**Will this break my local dev server's WebSocket (Vite, webpack, etc.)?**
Generally no. The new prompt targets pages loaded from the public internet reaching into a local or loopback address; a page you load directly from localhost connecting back to that same localhost server is same-origin and isn't the pattern this restriction targets.

**What exactly triggers the new permission prompt?**
A web page from a public origin attempting to open a WebSocket connection to a device on your local network or to a loopback address like 127.0.0.1.

**Is Chrome adding the same protection?**
Yes. Chromium has been testing the equivalent restriction since Chrome 142 and is targeting a default-on rollout in Chrome 147.

**Can I stop the prompt from appearing every time?**
Yes, Firefox lets you tell it to remember your choice for a given site so you won't be asked again on future visits.

**Can businesses manage this setting across many computers?**
Yes, Firefox provides enterprise policies to pre-approve or block specific URLs and to control prompting behavior organization-wide.

## Sources

- [Firefox 154.0, See All New Features, Updates and Fixes](https://www.firefox.com/en-US/firefox/154.0/releasenotes/), Mozilla
- [Local network access](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Local_network_access), MDN Web Docs
- [Intent to Ship: Local network access restrictions for WebSockets](https://groups.google.com/a/chromium.org/g/blink-dev/c/O6GMKt44Ups), Chromium blink-dev
- [Firefox 154 release notes for developers](https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/154), MDN Web Docs