Why the browser asks permission
A channel normally lives on a different origin from the directory page. Before JavaScript can inspect its manifest and segments, the media server must return an appropriate Access-Control-Allow-Origin header. This protects users and services from one website freely reading another website’s data.
Every request counts
Allowing the master manifest is not enough. Variant manifests, encryption keys and media segments can use different hosts, and each response needs compatible policy. Credentialed requests require a specific origin and careful cache variation; a wildcard cannot be combined casually with credentials.
The correct fix is at the source
A viewer cannot reliably solve CORS with a browser extension, and a public proxy creates privacy, security and cost risks. The broadcaster or CDN should explicitly permit the approved web origin, test redirects and expose only the headers the player needs.