UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36

Steps to reproduce the problem:
1. Visit http://dev.utkarshgoel.in/index_nonminify.html and monitor the network activity in the devTools. 

This page downloads resources from three origins: dev.utkarshgoel.in, dev1.utkarshgoel, and dev2.utkarshgoel.in. Resources downloaded from all three origins have the "Timing-Allow-Origin: *" HTTP header present. 

In my testcase, I made the server add multiple "Timing-Allow-origin: *" headers for the origin  "dev2.utkarshgoel.in".

2. To check whether the Resource Timing data shows timing information for the resource downloaded from dev2.utkarshgoel.in, in the console tab of devTools, type:

>performance.getEntries("resource")[6]['name']
to know the URL of the resource downloaded from dev2.utkarshgoel.in, 

Next, type in the console:

> performance.getEntries("resource")[6]['domainLookupStart']
to know the value of the start time of the DNS lookup

You will find that the start time of the DNS lookup has a value equal to 0, even when the "Timing-Allow-Origin: *" header was present for this resource's HTTP header.

3. Next, in the console, type:

>performance.getEntries("resource")[5]['name']
This will provide the URL of the resource loaded from dev1.utkarshgoel.in, which has exactly one occurrence of the "Timing-Allow-Origin: *" header. 

Now in the console, type:

> performance.getEntries("resource")[5]['domainLookupStart']
This will give you the start time of the DNS lookup for dev1.utkarshgoe.in, which is a value greater than 0.

This indicates that the Timing-Allow-Origin worked as expected for the origin dev1.utkarshgoel.in, allowing the origin "dev.utkarshgoel.in" to access the timing information for the resource from "dev1.utkarshgoel.in".

What is the expected behavior?
The browser should have made available the timing information for the resource downloaded from the origin "dev2.utkarshgoel.in" because it had the "Timing-Allow-Origin: *" present in the HTTP header

What went wrong?
Since the browser received multiple "Timing-Allow-Origin: *" headers, it concatenated the values present on all the "Timing-Allow-Origin" header, which resulted in the final value of "*, *". This value neither matched the origin name "dev.utkarshgoel.in" nor it matched the wildcard hostname "*". 

Did this work before? No 

Does this work in other browsers? No
 The same bug applies in Webkit (Safari). Please follow the steps below to reproduce the bug in Safari.

Chrome version: 65.0.3325.181  Channel: stable
OS Version: OS X 10.11.6
Flash Version: 

This bug is related to the Resource timing API