Browser-based attacks are not new in the malicious landscape of attack patterns. Browsers remain a popular infiltration method for attackers, as this remains an open door just waiting to be exploited. While seemingly local, services running on localhost are accessible to the browser using a flaw we found, exposing the ports on the localhost network interface, and leaving the floodgates ajar to remote network attacks. In this live demo and attack simulation we’ll unveil a zero-day vulnerability in Chrome and other browsers and why Microsoft Edge was the only browser unaffected, and how we use the 0-day to attack developers behind firewalls. We will demonstrate remote code execution on a wildly popular open-source platform serving millions in the data engineering ecosystem, that seems to run on localhost, and how Edge on Windows is “king” for 0.0.0.0-day prevention. We’ll demonstrate how through an inherited vulnerability in the Chrome browser it’s possible to attack localhost services using arbitrary code execution, bypassing the latest security mechanisms. In our talk, we will present novel attack techniques, targeting developers and employees within an organization, that are behind firewalls. This talk will showcase how this very same zero-day can be triggered against any open-source project that communicates over plain-text HTTP and listens on localhost; from ArgoCD to Grafana, Prometheus, Spark, OpenTelemetry… you name it. This will be a first-ever deep dive into this newly discovered zero-day vulnerability, which will cover the TTPs of the attack and methods to protect against them.