As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain.
I understand that this is important to prevent a page from grabbing private data and passing it along somewhere else. For example, without the SOP, I could write a public web page with a script that:
- reads information from an intranet site only accessible to the client browser (but not to my server) and
- sends it back to my server using
fetch() even later.
So - what attacks did the SOP prevent without a way to send a request? Obviously, without SOP a script could grab all kinds of potentially private data, but where is the risk if the script has no way to pass it on?
However, it does not explain why "fetching private information" is a problem if there is no way for the script to exfiltrate it.
window.nameexfiltrate across domains, or GET requests to any domain via iframe/img/embed/script/object tags, popups, etc.