Hacker News Reader

Maybe, but the CORS spec says otherwise.

See the note.

Interesting that the spec disagrees with the implementation. Maybe the multi-origin leakage was filed as a bug somewhere and fixed post-spec?