Subdomains are excluded: the same-origin policy prevents that. You can still request resources (like images) from other domains, but usually there's no direct w

Subdomains are excluded: the same-origin policy prevents that. You can still request resources (like images) from other domains, but usually there's no direct way to access the response to such requests. So you can't just fetch some JSON data from an API endpoint from another domain unless it's explicitly allowed by CORS, or workarounds like JSONP are available. If the target doesn't implement CSRF protection, this might still be enough to trigger unwanted actions. So if I add <img src='http://192.168.1.1/cgi-bin/reboot.cgi'> http://192.168.1.1/cgi-bin/reboot.cgi'> to a website, this might reboot your router, if it's rubbish. No rebinding needed for that. Rebinding enables you to do more than that. A vulnerable service can be interacted with just like your local backend. So you can send queries and read responses.