I'm 99% sure this is not a thing and if it was it would be incredibly broken and not secure and most non-trivial pages relying on it for security would be vulnerable to the third party script.

Anyway. This can easily be proved one way or another. `Here is an example that shows a third party script accessing a first party domain. There is no CORs as far as I can see:

https://jsfiddle.net/aopmtn46/

If you open the console you will see "STATUS 404" which is not possible if same origin on third party scripts is enforced.