Top-level site A (Use SHIFT-refresh to update it)

B/corp/allow-cors/logo.png w/"crossorigin" (image1):
B/corp/logo.png (image2):
B/logo.png (blocked if we require-corp) (image3):

Canvas: