I'm 99% sure this is not a thing and if it was it would be incredibly broken and not secure and most non-trivial pages relying on it for security would be vulne

I'm 99% sure this is not a thing and if it was it would be incredibly broken and not secure and most non-trivial pages relying on it for security would be vulnerable to the third party script. Anyway. This can easily be proved one way or another. `Here is an example that shows a third party script accessing a first party domain. There is no CORs as far as I can see: https://jsfiddle.net/aopmtn46/ https://jsfiddle.net/aopmtn46/ If you open the console you will see "STATUS 404" which is not possible if same origin on third party scripts is enforced.