Announced September 23: Chrome 152 introduces connection allowlists, a security mechanism that lets you create a strict network sandbox for your documents and workers. In plain terms: instead of hoping your third-party scripts call only where they should, the page declares the full list of reachable hosts, and the browser blocks the rest.
Who should reach for it
- Sites that embed third-party widgets they cannot vet line by line: analytics, chat bubbles, payment overlays.
- Apps processing sensitive data where a rogue dependency calling home is the threat model, not a hypothetical.
- Anyone who has already written a Content-Security-Policy and hit the edge cases CSP does not cover: this is the network layer behind that thinking.
The honest workflow is unglamorous: inventory every host your page actually contacts, write the allowlist, then watch the console during your next full regression pass. The first cut is where the surprises live. gacor defense in depth; ungacor to discover a missed vendor on launch morning.