I was developing an extension that automatically saves all loaded images without repeating requests by loading them into a canvas and extract the binary data. I

I was developing an extension that automatically saves all loaded images without repeating requests by loading them into a canvas and extract the binary data. I was forced to modify CORS because otherwise the canvas is tainted with cross-origin images. (I consider CORS related headers to be security headers as well.)