[lincolnq]

Iframes bypass CORS, so the trick is to use an Iframe and figure out (using some side channel since you can’t peek into the frame) whether the iframe loaded the content successfully or whether it loaded an error page.

[throwawayadvsec]

I mean websites that blocks cors usually blocks iframes too?