Thanks a lot Brent!
This is indeed the issue, I can finally reproduce it.
I'm so happy! And this means I can even detect it and fix it! What a great news :)
Have a great day :)
Best regards, Juraj Mäsiar
We've seen a similar issue when a user removes the "<all_urls>" permission from the extension by right-clicking on the Chrome toolbar icon and selecting something other than the "on all sites" option. If a fetch is then done from the service worker or background page, Chrome sends a preflight request to the server to verify access.
While researching our issue, I also came across this Chrome bug.
https://issues.chromium.org/issues/351623257