Bug #1789128 - Cross-Origin URL Steal is possible using performance.getEntries()