mask-image-cors-disallow-origin.html

<!doctype html>
<style>
#target {
  width: 200px;
  height: 200px;
  background-color: green;
  /* Cross-origin request is not OK because a "Access-Control-Allow-Origin:" header is not returned. */
  -webkit-mask-image: url("http://localhost:8080/security/resources/image-access-control.php?file=../../resources/square100.png&allow=false");
  -webkit-mask-repeat: no-repeat;
  -webkit-mask-position: center;
}
</style>
<div id="target"></div>

chromium/third_party/blink/web_tests/http/tests/security/mask-image-cors-disallow-origin.html