Add browser extensions to your cross-origin resource sharing (CORS) list to allow requests for Salesforce REST resources. Previously, the CORS allowlist supported only websites and IP addresses. For example, you can now allow an appointment management browser extension to view and work with your Salesforce records. Browser extensions that aren’t on your CORS allowlist are blocked from requesting resources.
Where: This change applies to Salesforce Classic and Lightning Experience in Developer, Enterprise, Performance, and Unlimited Editions. It also applies to Professional Edition with API access enabled.
How: From Setup, in the Quick Find box, enter CORS, and then select CORS.