I dont understand how is it possible that browser would allow crossdomain request from attacker website to victim website? Unless victim has some CORS headers allowing all sites to query it?