UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.84 Safari/537.36

Steps to reproduce the problem:
Make a cross-origin request with
XMLHttpRequest.withCredentials = false;
or with:
fetch('https://example.com', {credentials: 'omit'});

What is the expected behavior?
The error should not have been thrown.

What went wrong?
Receive a Cross-Origin Resource Sharing (CORS) error.

Did this work before? No 

Does this work in other browsers? N/A

Chrome version: 68.0.3440.84  Channel: stable
OS Version: OS X 10.12.6
Flash Version: 

Native apps are able to make a cross-origin, credential-less requests without the need of the CORS header. Web Apps should have the ability to make credential-less requests cross-origin without requiring the origin to state that the request is allowed. Credential-less requests pose no threat to the requesting server. 

Without this feature, it is more likely that a server-administrator will unknowingly add `Access-Control-Allow-Origin: *` to ALL requests (even credentialed requests), thereby creating a security vulnerability where there wasn't one before. The browser should do all of this for everyone and there isn't a good reason why it shouldn't.