From a9fe9359a18816fe73ad237ab2091dc5b192aef3 Mon Sep 17 00:00:00 2001
From: Simon Pieters <zcorpan@gmail.com>
Date: Mon, 18 May 2026 14:16:47 +0200
Subject: [PATCH] Also check CORS-same-origin in the <link> quirk

Fixes #12403.
---
 source | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/source b/source
index a156a0f998c..f2d324ce812 100644
--- a/source
+++ b/source
@@ -29617,8 +29617,9 @@ document.body.appendChild(wbr);</code></pre>
 
   <p><strong>Quirk</strong>: If the document has been set to <span>quirks mode</span>, has the
   <span>same origin</span> as the <span>URL</span> of the external resource<!-- CVE-2010-0654 -->,
-  and the <span data-x="Content-Type">Content-Type metadata</span> of the external resource is not a
-  supported style sheet type, the user agent must instead assume it to be <code>text/css</code>.</p>
+  the external resource is <span>CORS-same-origin</span>, and the <span
+  data-x="Content-Type">Content-Type metadata</span> of the external resource is not a supported
+  style sheet type, the user agent must instead assume it to be <code>text/css</code>.</p>
 
   <div algorithm>
   <p>The <span>linked resource fetch setup steps</span> for this type of linked resource, given a