"... only from the same subnet" What about DNS rebinding (decade old unpached vuln)? It allows websites to issue requests onto your local subnet. Actually...

"... only from the same subnet" What about DNS rebinding (decade old unpached vuln)? It allows websites to issue requests onto your local subnet. Actually... Issuing a request doesn't even require any vuln, it's not a SOP violation...