The PNA specification requires that when a context of a lower security level accesses an address of a higher security level, the browser must first send a CORS preflight request, and only after the target server returns Access-Control-Allow-Private-Network: true will the actual request be allowed through.