--disable-web-security simply allows a user to fetch any URL, but the underlying issue here is that you can fetch URLs despite them being defined in the URLBlacklist.

For example, I added https://www.google.com/k to the black list, went to http://phistuck-app.appspot.com/ and ran fetch("k") in the console - it was not blocked.
(When I tried to navigate to it, it was blocked, though)

I would add that the normal behaviour of Chrome - allow AJAX requests even to blocked URLs is actually okay - typically if you allow a site in the URLWhitelist, you want that site to function correctly for users, so any underlying resources fetched by AJAX (with the correct CORS headers) are a-okay in my book.

The problem is --disable-web-security (or any other means by which CORS is disabled). With that, plus the above behaviour, the whole web is open to a user with a bit of Javascript knowledge.

Looks like the issue can't be triage from TE end.Adding respective label for further triage help.