0b3ada29_er_enabled_Cross_Site_Requests__Site_Communication_Mechanisms_Security_Considerations
[Description of Mechanism] XDomainRequest API [Conforming User Agents] IE8 beta Introduces a new method exposed to window for GET and POST requests that has similar syntax to XMLHttpRequest but has a different method name. See XDomainRequest. [Security Considerations] 
Users may not be aware that such transactions taking place, but in general, data from Data Site is public and not private. Can be used to POST random content to servers; the POST method is not pre-flighted.
Browser-enabled Cross Site Requests
Security Considerations