Same origin policy protects us from malicious site manipulating the data on our trusted site by not allowing requests that would send the auth cookie e.g. But if I understand correctly images, scripts, etc. are an exception from that rule.
See e.g. here:
A web page may freely embed images, stylesheets, scripts, iframes, videos.Certain "cross-domain" requests, notably AJAX requests, however are forbidden by default by the same-origin security policy.
Does that mean that if I have a "secret image" on Facebook (or any other resource with cookie session auth) any malicious site that I accidentally visit will be able to load that image in a hidden tag e.g. and read it? They should definitely know the url, but for many sites it can be as easy as guessing ids (or enumerating them 1,2,3...).
This does not sound any secure to me. Am I missing a point here? Seems that auto-sending of cookies for all requests and cookies in general is just evil for security (not for the ads though that are hugely based on this "nice" feature if I remember correctly).
It should be even worse for iframe (if you can embed and read data from a bank iframe e.g.), so it has to be protected somehow.