Researchers warn about a hacking technique that enables attacks on the local network using JavaScript on a public website. Using the victim’s browser as a proxy, the code can reach internal hosts and do reconnaissance activity. The method is not fully obstructed by the same-origin policy (SOP), the web app security model that restricts interaction between pages of different origin. The technique takes advantage of how the SOP typically functions in a browser, allowing cross-origin embedding and writing between two different origins and blocking reading the response.
Source: https://www.bleepingcomputer.com/news/security/assessing-internal-network-with-javascript-despite-same-origin-policy/