The assumption here is that the attacker controls a domain A, and the victim is visiting A. The victim is also logged into a benign site, with domain B. A's COR

The assumption here is that the attacker controls a domain A, and the victim is visiting A. The victim is also logged into a benign site, with domain B. A's CORS policy is irrelevant, the attacker can "disable cors" for A, but it will accomplish nothing, B has CORS enabled. The attacker could make an HTTP request to B and set 'no-cors' or whatever, but then it couldn't include credentials (if you're using HTTP cookies), and again, B would still just reject the request. So I'm not sure what you're saying is true. This isn't my area of security, happy to hear if I'm mistaken.