chromium/third_party/blink/web_tests/http/tests/security/mask-image-cors-same-origin.html

<!DOCTYPE html>
<style>
#target {
  width: 200px;
  height: 200px;
  background-color: green;
  /* Access is OK because the URL and this document have the same origin. */
  -webkit-mask-image: url("/resources/square100.png");
  -webkit-mask-repeat: no-repeat;
  -webkit-mask-position: center;
}
</style>
<div id="target"></div>