Correct me if I'm wrong but the browser still sends the request. The browser checks for the response's CORS headers to see if the response can be used but ther

Correct me if I'm wrong but the browser still sends the request. The browser checks for the response's CORS headers to see if the response can be used but there's potentially an attack vector even when the response is ignored.