This is a welcomed change as it prevents unrelated sites from making XHRs to unrelated sites (already mitigated by browser restrictions with allow credentials and very loose Access-Control-Allow-Origin server headers) but I'd like to point out that if someone stole your cookies via a XSS request they could free themselves of browser restrictions by making requests by not using a browser.
This is particularly a problem for sites that have XSS vulnerabilities and don't use the http only property for sensitive cookies and non-https sites on open wifi networks. Sites should use a combination of secure (cookies transmitted over https only) and http only (JS can't access the cookie) cookies and redirect all http traffic to https. Ad networks need to get better at helping sites monetize on https only traffic, it's a huge barrier for many sites making the switch and helping the internet finally relegating plain text http traffic to the history books.
This is particularly a problem for sites that have XSS vulnerabilities and don't use the http only property for sensitive cookies and non-https sites on open wifi networks. Sites should use a combination of secure (cookies transmitted over https only) and http only (JS can't access the cookie) cookies and redirect all http traffic to https. Ad networks need to get better at helping sites monetize on https only traffic, it's a huge barrier for many sites making the switch and helping the internet finally relegating plain text http traffic to the history books.