You're running a Bitcoin node on the same machine as your Firefox browser? Yeah, I and everybody else can tell…
Firefox allows web pages to make cross-origin requests to localhost. This means any website you visit in Firefox can silently probe ports on your local machine. Chromium-based browsers (Chrome, Brave, Edge) block this via the Private Network Access spec. Firefox does not implement PNA.Probably you shouldn't be doing a whole lot else on the computer that runs your node. If you only have one device, you could consider not having your node always-on -- I believe this attack doesn't work if your node is not actually running.
Or just don't use firefox.
there's a trick to avoid localhost...
edit your localhost table with FQDN that cannot be accessed from outside your LAN.
But anyways, a node machine it suppose to be a dedicated machine accessed from LAN from another devices and not use it as a regular machine with a browser...
I think they might have patched this. I do a lot of web development using Firefox and I recently noticed Firefox asking me for extra permission when I use Drizzle Studio. It didn't use to ask for it, but now it doesn't work unless I give it permission.
I think the new permission dropped in Firefox 150. https://firefox-admin-docs.mozilla.org/reference/policies/localnetworkaccess
Ah, thanks for the update!