localhost is "this device".

connecting to localhost means connecting to something running on the same machine.

Browsers generally block connections to other domains (ex if you're on google.com, the browser won't simply let the site contact amazon.com willy-nilly).

But localhost is your own machine, so it is usually "trusted". Facebook exploited this fact to exfiltrate data from the browser to the other apps running on your own phone, which would, in turn be free to do with it as they please, because they're not the browser