Spin-off from bug 88139. Say: $origin = "foo\0" Access-Control-Allow-Origin: $origin For some reason, chromium-linux seems to be dropping the trailing null character. Maybe a peculiarity in the chrome network stack? Couldn't reproduce locally with a chromium-mac build, so i'm not sure if it's just with a case like the example above or if it's a general problem with null characters (i.e. would foo\0bar be read like foo?)