notably

Windows is not impacted by this issue.

quoting the main, critical part:

1. Under public domain (.com), the browser sent the request to 0.0.0.0.
2. The dummy server is listening on 127.0.0.1 (only on the loopback interface, not on all network interfaces).
3. The server on localhost receives the request, processes it, and sends the response.
4. The browser blocks the response content from propagating to Javascript due to CORS.

This means public websites can access any open port on your host, without the ability to see the response.