What happened?

extensions/browser/src/browser/navigation-guard.test.ts > browser navigation guard > allows blocked hostnames when explicitly allowed fails deterministically (locally on macOS and on a Linux Testbox, Node 24):

AssertionError: promise rejected "SsrFBlockedError: Blocked: resolves to private/internal/special-use IP address" instead of resolving
  Caused by: SsrFBlockedError
   at assertAllowedTrustedHostnameResolvedAddressesOrThrow src/infra/net/ssrf.ts:449
   at resolvePinnedHostnameWithPolicy src/infra/net/ssrf.ts:595
   at assertBrowserNavigationAllowed extensions/browser/src/browser/navigation-guard.ts:159

Suspected provenance

a00e9fc228d fix(ssrf): block loopback addresses for trusted hostname origins (#100835) tightened trusted-hostname resolution in src/infra/net/ssrf.ts; the browser extension's explicit-allowlist contract ("allows blocked hostnames when explicitly allowed", private-IP hostname agent.internal) now gets blocked before the allowlist can apply. Either the SSRF policy needs to honor the browser extension's explicit allow, or the extension contract/test needs updating to the new policy — a product decision for the SSRF/browser owners.

Reproduction

node scripts/run-vitest.mjs extensions/browser/src/browser/navigation-guard.test.ts at 6683a86 (current main lineage) → 1 failed / 25 passed. Test and navigation-guard.ts are untouched since long before #100835.