One: A common misunderstanding (dispelled by annevk long ago) about CORS is that it is some kind of defence. I think some overeager middleware libraries can be blamed for this confusion, but I'm starting to wonder whether CORS error messages (in Chromium specifically) could be improved:

Access to fetch at 'https://example.org' from origin 'https://example.com' has been blocked by CORS policy. [...]

(my emphasis)

The phrase "blocked by CORS policy" seems to mislead some practitioners into conflating the effects of the SOP and CORS. How about something like the following message instead?

Access to fetch at 'https://example.org' from origin 'https://example.com' has been blocked because the requested resource's CORS policy is insufficiently permissive. [...]

(my emphasis)

Two: Some folks attempt to solve their CORS issues by including an Origin header in their request. Of course, because Origin is a forbidden request-header name, user agents deny clients' attempts to include such a header in a request. The XHR API is vocal about it and issues an error message:

httpRequest = new XMLHttpRequest();
httpRequest.open('GET', 'https://www.example.com', true);
httpRequest.setRequestHeader("Origin", "http://localhost")
httpRequest.send(null);

In Chrome and Safari:

Refused to set unsafe header "Origin"

And in Firefox:

Attempt to set a forbidden header was denied: Origin

However, the Fetch API denies such attempts silently:

fetch('https://example.com', {headers: {origin: 'http://localhost'}});

(no error message about Origin being unsafe, per the Fetch standard)