Arbitrary websites can request localhost urls unless they have the appropriate headers, and this only protects against some request types. Specifically, POST is not blocked by a lack of an Access-Control-Allow-Origin header. ActivityWatch does not appear to have one, so the browser should block requests from webpages loaded from remote urls.
$ curl -vv -H "Origin: http://attacker.com" http://localhost:5600
* Trying 127.0.0.1:5600...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 5600 (#0)
> GET / HTTP/1.1
> Host: localhost:5600
> User-Agent: curl/7.68.0
> Accept: */*
> Origin: http://attacker.com
>
* Mark bundle as not supporting multiuse
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
< Server: Werkzeug/2.1.2 Python/3.9.14
< Date: Mon, 26 Jun 2023 15:13:41 GMT
< Content-Disposition: inline; filename=index.html
< Content-Type: text/html; charset=utf-8
< Content-Length: 1683
< Last-Modified: Mon, 26 Sep 2022 19:14:27 GMT
< Cache-Control: no-cache
< Date: Mon, 26 Jun 2023 15:13:41 GMT
< Connection: close
https://about.gitlab.com/blog/2021/09/07/why-are-developers-vulnerable-to-driveby-attacks/
Arbitrary websites can request localhost urls unless they have the appropriate headers, and this only protects against some request types. Specifically, POST is not blocked by a lack of an
Access-Control-Allow-Originheader. ActivityWatch does not appear to have one, so the browser should block requests from webpages loaded from remote urls.https://about.gitlab.com/blog/2021/09/07/why-are-developers-vulnerable-to-driveby-attacks/