Connection Allowlist is a new WICG browser security proposal currently in Chrome origin trial (Chrome 148–151) that lets a document declare an explicit allowlist of network destinations. Any outbound connection not on the list is blocked at the network layer before leaving the machine, covering fetch/XHR, WebSocket, WebTransport, DNS prefetch, navigations, redirects, and WebRTC. Unlike CSP's directive-based approach, Connection Allowlist applies a single unified boundary to all outbound connections. Redirects and WebRTC are blocked by default and require explicit opt-in. The mechanism complements CSP rather than replacing it: CSP controls content and execution, while Connection Allowlist limits where a page can send data. Violations are reported via the Reporting API using a Report-Only header for safe deployment. Report URI already collects these reports in beta.
