Ubiquiti routers have a fairly magical browser SPA that can run on their domain and talk to local routers. It involves webrtc connections to local addresses.
But I think if same-origin were enforced more strictly, they could have found another way.
It does this most of the time, either through the cloud or direct to the controller. But during setup of the first device on a network it does something direct from the browser to get it connected to the cloud.
But I think if same-origin were enforced more strictly, they could have found another way.