Share via

Outlook Add in - Chrome update 142 causing CORS errors for Webmail Outlook

Douglas Riggs 40 Reputation points
2026-02-04T19:45:45.85+00:00

We have an add in application we've developed for all outlook versions, which has a separate url but connects to our main application. For the webmail outlook versions, with recent chrome versions we have been getting cors errors such as this:
Screenshot 2026-02-03 at 12.23.52 PM

This used to work, but it seems that from version 141 -> version 142 of Chrome, Google changed the security related to iframes, and it no longer works.

This seems to be because our publicly hosted add in is connecting to our private server instance.

Would it be possible on your side to add the 

allow="local-network-access"

property to the hosting iframe for add-ins within outlook? This would fix the issue for us.

Or is there someway to disable this flag at an enterprise level?

chrome://flags/#local-network-access-check

It works in the browser if we do this, but wouldn't be possible in webmail windows implementations, and it's hardly reasonable to ask every user to make this change before the add in works.

Or is there another solution that we are missing?

Moderator note: Moved from Outlook | Web | Outlook.com | Email

Microsoft 365 and Office | Development | Other
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Teddie-D 11,990 Reputation points Microsoft External Staff Moderator
    2026-02-05T03:15:41.7166667+00:00

    Hi @Douglas Riggs
    Thank you for posting your question in the Microsoft Q&A forum.  

    Based on my findings, this issue has been reported by multiple users and specifically affects Outlook on the web (OWA). Chromium‑based browsers such as Chrome and Edge recently introduced Local Network Access (LNA) restrictions, which prevent Outlook add‑ins from sending requests to localhost or other private‑network endpoints. Because the add‑in runs inside an iframe, users cannot override this behavior, as LNA must be delegated by the parent frame rather than the add‑in itself. 

    From this discussion Outlook blocking addin request to localhost webserver · Issue #6426 · OfficeDev/office-js. A fix has already been deployed, and the changes are expected to roll out globally within the next 2–3 weeks. 

    I hope this helps clarify the situation and provide reassurance that Microsoft is actively addressing the issue. 

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.  

  2. Douglas Riggs 40 Reputation points
    2026-02-04T19:52:48.3066667+00:00

    And I guess I should say, it would be totally fine if there is some property that we can add to the manifest file to enable this.

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.