AIKIDO-2026-10702

TL;DR

Protocol handlers that registered the Fetch-compatible path with only the fetch surface enabled could still serve cross-origin fetch and XHR requests from untrusted web contexts without the explicit CORS opt-in, and cross-origin no-cors fetches were not consistently treated as opaque. That let remote pages read custom scheme response bodies in situations that should have been CORS- or opacity-gated, undermining the isolation model for those handlers. The loader now enforces the CORS-disabled scheme rule for that configuration and returns opaque bytes for disallowed cross-origin no-cors requests so cross-site code cannot access the scheme payload unless CORS is deliberately enabled.