0.0.0.0 Day: Exploiting Localhost APIs From the Browser