I was gearing up to test this when i made an addressing error. Turns out it even blocks "cross-site" from `http://127.0.0.1` to `http://localhost` from the same tcp port.

Brave browser does prevent this by default, at least this is my understanding. It does seem like a good browser security default would be to block remote sites from calling `localhost`. I am sure there are sites this would break but it could warn you that a site attempted this and allow you to allow it.