Ha, I feel your pain, I ran into something similar with Chrome and Cloudfront. For us it got triggered because an image on the site appeared both as a video "p

Ha, I feel your pain, I ran into something similar with Chrome and Cloudfront. For us it got triggered because an image on the site appeared both as a video "poster" attribute (which loads with CORS) and as a regular image. So depending on which image the user encountered first you would see a CORS error. But it would be gone after a reload, so devilishly hard to reproduce until you realise what's happening. Also took me ages to figure out that Cloudfront didn't include the Origin in the Vary header if it wasn't in the original request. (@jaffathecake perhaps that Cloudfront behaviour warrants a special mention. Great article by the way, I learned a lot)