← Back to release summary

Block HTTP ports 5060 and 5061

Category
Network / Connectivity
Type
No developer-visible change
Status
Enabled by default (Chrome 87)
Intent stage
Shipped

Summary

Connections to HTTP, HTTPS or FTP servers on ports 5060 or 5061 will fail. This is a mitigation for the slipstream attack: https://samy.pl/slipstream/. It helps developers by keeping the web platform safe for users.

Motivation

The Slipstream attack is a kind of cross-protocol request forgery which permits malicious internet servers to attack computers on a private network behind a NAT device. The attack depends on being able to send traffic on port 5060 (SIP). As a mitigation to protect users, this change will prevent connections on port 5060. To be on the safe side, and to align with other browsers, it also blocks port 5061 (SIP over TLS).

Standards & signals

View on chromestatus.com