VULNERABILITY DETAILS
Using `cross-site printing' (= cross-protocol request to port 9100 of a network printer), it is possible to perform attacks against intranet printers using the web browser as carrier. This issue has already been demonstrated in 2007 by Aaron Weaver to send printer spam or even to update the firmware for specific models.

A new version of the attack has lately been published, which allows malicious websites to bypass the same-origin policy and access data on the device by making the printer respond with a valid HTTP header including `Access-Control-Allow-Origin: *' using PostScript echo commands. It works on alymost any laser printer. A detailed description of the `CORS spoofing' technique can be found here: http://hacking-printers.net/wiki/index.php/Cross-site_printing

VERSION
Chrome Version: generic (tested with Chrome 52)
Operating System: generic

REPRODUCTION CASE
Proof-of-concept code which uses WebRTC to obtain the victim's local IP address and quickly enumerate printers in the LAN and list files on them can be found here: http://hacking-printers.net/xsp/

XSP in combination with CORS spoofing allows a web attacker to capture printed documents, obtain passwords stored on the device etc. Various attacks are documented here: http://hacking-printers.net/

This is not a bug in Chrome, but based on the abuse of legimtimate web standards (XHR, CORS, WebRTC) and the feature of a service/protocol to echo arbitrary strings.

A solution/workaroud would be to to add port 9100 to the list of blocked ports:
https://src.chromium.org/viewvc/chrome/trunk/src/net/base/net_util.cc?view=markup

Or maybe even disallow internet based websites to access intranet addresses at all by denying all requests from external to internal resources (at least if they use the private address spaces defined in RFC1918)? I can't think any website it would break.