 <p>Well actually all browsers comply with the same-origin policy. The reason for it is that if the policy didn't apply, upon visiting evil site, that site would essentially control your browser, could take use of any active sessions and cookies etc. You would be able to make ajax requests to any website the person is logged in using his session and perform virtually any task you'd like. You could also make requests to different ports, which again could be abused, used to make zombies, and hundreds other things more creative people would think off...</p> <p>Essentially the integrity of all your session would be gone upon visiting a any site. </p> <p>I would suggest reading <a href="https://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy" rel="nofollow">this</a> for a detailed explanation of the issue.</p>