The post at http://security.stackexchange.com/a/43456/8340 (incorrectly?) states
However, I was pretty sure that a framed website cannot be accessed unless it is the same domain, regardless of CORS settings:
an iFrame cannot read the contents of another iFrame unless they are on the same domain.
Frames have scripting rights and protections granted by the Same-Origin Policy. A script executing on a parent cannot read the contents of a child iframe that is of another domain.
So my question is, if CORS is implemented, is it possible for one domain to read content from another domain without issuing an AJAX request?
e.g. in the first post
Victor can verify the contents of the HTML it retrieves and verify all referenced scripts as well.
How would this be achieved? Can it be achieved without AJAX (i.e. is it possible to read cross frame or via any mechanism in the DOM, or is it a case of one site issuing an AJAX request to the other?).