From what I've seen, someone can add the following code to a malicious site (lets say: http://sth.malicioussite.com) and be able to perform ajax post requests to a 3rd party site, along with any cookies set before:
var xhr = new XMLHttpRequest(); xhr.open("POST", "http://mysite.vulnerablesite.com/mysite/deleteUser"); xhr.withCredentials=true; xhr.send(["userId=5"]);
If you test this on a browser, you will get an error on the console ( Cross-Origin Request Blocked), but the request will actually be sent. What you are not allowed is just to see the result of the request.
If this is not a problem of the spec, or a chromium/firefox implementation issue, then what should be the protection from such attacks?