I was also surprised to read: "the browser explicitly ignores any CORS policy for servers running on localhost." on the Zoom vulnerability writeup. Among all t

I was also surprised to read: "the browser explicitly ignores any CORS policy for servers running on localhost." on the Zoom vulnerability writeup. Among all the W3 specs, the CORS one is definitely not the largest spec. See https://www.w3.org/TR/cors/ https://www.w3.org/TR/cors/ Ultimately the Zoom vulnerability reminded us that there is always a trade off between usability and security. Most of the developers default to usability and simplicity. The average developer looks for the fastest way to achieve "what I want to do". And they do not even question installing stuff with "curl https://any.domain.com/any-script https://any.domain.com/any-script | sudo bash". And that is the root of all evils.