Um... How about NO.

[kajer@infosec.exchange]

I'll just have to take comfort in knowing 300+ of my users allow this

[fritzadalis@infosec.exchange]

@kajer
You're right @Sempf, we need to get rid of browsers.

[sempf@infosec.exchange]

@FritzAdalis @kajer you know I'm not saying. I'm just saying.

[jesstheunstill@infosec.exchange]

@kajer I have seen a case where that is required. Basically, your loopback address is also your local network. So if it's talking to an endpoint agent or local service for some reason, it needs those permissions in order to talk via loopback. It freaked us out with Okta a while back.

[kajer@infosec.exchange]

@JessTheUnstill I have seen that behavior in things like DUO device health, where the DUO MFA page connects to the localhost instance to pull the device posture json file...

I have NEVER seen GMAIL ask for that. Point is, denied.

[jesstheunstill@infosec.exchange]

@kajer Yeah certainly. I suppose it could also be the Google workspace MDM? https://workspace.google.com/intl/en_uk/products/admin/endpoint/

[kajer@infosec.exchange]

@JessTheUnstill Maybe?

There are two possibilities if it is.

1. Chrome did an update that may have added a new permission dialog.
2. Workspace MDM added a new "feature."

Our org has used workspace based mdm for YEARS and never once has that dialog popped for me until today.

[jesstheunstill@infosec.exchange]

@kajer both possible.

[kajer@infosec.exchange]

@JessTheUnstill looks like the permission flag was added later 2025, so chances are a mail I got had an internal IP address or something... or my DNS filters resolved a name to a local address (internal domain stuff possible)

huh

[charlesh@infosec.exchange]

@kajer I’ve been seeing that in Edge at work, but not at home. It is a bit frightening not knowing why… Figured it must be related to device management and calling home to tattle about TLS page content, but not sure. Around the same time I started getting browser toasts from Microsoft Purview when I pasted text in websites…