The vulnerability, in essence, arises because there is an assumption that an internet-origin website (example.net) should not generally be able to make XHR type requests via JS to 127.0.0.1:8080/blah, as this is a violation of CORS policy.
JS run from an internet website should not be able to interact with things on other origins, like your local PC, or your local network.
It appears that some browsers had some exemption for 0.0.0.0 (which can be used sometimes to refer to all IPs) - so if you were running a service bound to 127.0.0.1:8080, then in theory an internet service would be able to access it via 0.0.0.0:8080 when this bug is in effect. 0.0.0.0 is a reserved IP address (it's not a real one), commonly used to refer to "all IP addresses on this host" when you are setting up a server.
This could be a security issue as software running locally might (erroneously) assume that all local network traffic is secure - imagine a password manager communicating with its browser extension, for example, or a developer running a web service or database locally.
