Why doesn't the CORS policy block requests for third-party resources (domains) when uploading media files?

Question

CORS

Hello. Tell me why, if the DOM tree has links, for example, the img tag to third-party resources where images are stored, then CORS does not block such requests?

Answer 1

It just doesn't ask for origin permissions by default , but you can set the crossorigin attribute to change this behavior. <img>, <script>, stylesheet <link>, и <iframe>

Answer 2

CORS does not block what was allowed before, CORS allows what was previously not allowed. It was possible to read media files before.