I can understand why content from different domains is considered to be unstrusted for the same origin policy. But, how can be content from diferent protocols from the same site/domain be dangerous?
Can somebody give an example of a situation in which this can be a security concern?
To begin, an ORIGIN is composed of Protocol + ResourcePath + Port, so http:// is different to https://.
The reason why the protocol is included in the origin is because the document/resource is served, potentially, from a completely different system. HTTPS uses port 443 by default, HTTP port 80 by default. Additionally, even though you can transfer a plaintext file via FTP (port 21) HTTP (port 80), HTTP (port 443) etc. etc. each of these protocols have very different protections and controls in place.
The security concern comes primarily from questions around provenance. Big word, I know. This means, simply, that content served over port 443 is KNOWN to have originated from the place saying so. It has a certificate to prove it, that certificate is tied to a particular domain name, and if no shenaningans have been taking place and the method used correctly, you can be really sure that the content served over HTTPS came from who you expected it to come from. This is not the same for content coming from port 80 via HTTP. In fact, HTTP was designed to allow midway points to cache, and indeed modify the data on its way to you.
Because of these differences, content served from different protocols is seen to be within separate trust domains, which do not necessarily trust the security of the other. For example, lets say you view a webpage serving content via HTTPS (the HTML) and content via HTTP (the advertising scripts and images). Cross origin prevents lower trusted objects (advertising) from reading higher trusted content (the balance of your bank account).
CORS, at its core (haha) goes back to the Bell - La Padula model which is widely used today to separate low security clearance from high security clearance interactions.
