spec co-editor here.

SRI returns false (i.e. non-matching integrity) for scripts (or stylesheets) that do not enable CORS and are not same-origin [1]. Otherwise, an attacker could just disable CORS to bypass SRI.

flies away

[1] https://w3c.github.io/webappsec/specs/subresourceintegrity/#...