<p dir="auto">I have a program based on electron8.2.5, read the local pictures dragged and previewed, everything works fine. But after upgrading to electron9.0.0 today, the picture preview does not show up. It looks as if the parameter ‘webSecurity: false’ does not work.</p>
<h3 dir="auto">Preflight Checklist</h3>

<ul class="contains-task-list">
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have read the <a href="https://github.com/electron/electron/blob/master/CONTRIBUTING.md">Contributing Guidelines</a> for this project.</li>
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I agree to follow the <a href="https://github.com/electron/electron/blob/master/CODE_OF_CONDUCT.md">Code of Conduct</a> that this project adheres to.</li>
<li class="task-list-item"><input type="checkbox" id="" disabled="" class="task-list-item-checkbox" checked=""> I have searched the issue tracker for an issue that matches the one I want to file, without success.</li>
</ul>
<h3 dir="auto">Issue Details</h3>
<ul dir="auto">
<li><strong>Electron Version:</strong>  9.0.0

</li>
<li><strong>Operating System:</strong> Windows 10 (1904)

</li>
<li><strong>Last Known Working Electron version:</strong> 8.2.0

</li>
</ul>
<h3 dir="auto">Expected Behavior</h3>

<p dir="auto">Setting BrowserWindow webPreferences: { webSecurity: false } should disable the CORS policy</p>
<h3 dir="auto">Actual Behavior</h3>

<p dir="auto">Although I am receiving the electron security warnings for "Disabled webSecurity","allowRunningInsecureContent" and "Insecure Content-Security-Policy" in the console I am still getting COR policy errors on my requests.</p>
<p dir="auto"><strong>Here is an example:</strong></p>
<p dir="auto">Access to XMLHttpRequest at '<a href="http://localhost:8080/users/login" rel="nofollow">http://localhost:8080/users/login</a>' from origin '<a href="http://localhost:3000" rel="nofollow">http://localhost:3000</a>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.</p>