As per https://html.spec.whatwg.org/multipage/media.html#start-the-track-processing-model, the request should be same origin as fallback: Let request be the result of creating a potential-CORS request given URL, "track", and corsAttributeState, and with the same-origin fallback flag set.
Created attachment 457690 [details] Patch
Created attachment 457697 [details] WIP
Created attachment 458138 [details] Patch
Created attachment 458142 [details] Patch
Comment on attachment 458142 [details] Patch r=me once the bots are happy
<rdar://problem/92179016>
Committed r293311 (249934@main): <https://commits.webkit.org/249934@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 458142 [details].