The article examines how Zoom bypassed CORS with an image-based hack to trigger its localhost webserver, exposing a security flaw rooted in developers’ confusion over same-origin policy. It outlines a secure solution—using strict Access-Control-Allow-Origin headers and CSP for localhost—and calls for clearer CORS education.