Websites could scan your local network covertly up until a few years ago; now it requires explicit permission (like notifications, location, etc)

XSS never a thing in your world?