Comment by mattmanser

But that means they can't verify it, right? Couldn't a malicious actor use this to attack their competitors?

Add an internal DNS entry for your competitor's domain, spin up an internal server hosting some malware and open it from chrome.