Localhost is typically uniquely trusted, generally speaking, even when loading a localhost page on HTTP it behaves like a page served over HTTPS would (in terms of the browser APIs you have access to for example). Also for a port scan it's not all that unusual since you can do it without loading any resources, so CORS alone wouldn't protect you from it. Maybe an extension that injects / modifies CSP rules could protect from this but it might also end up breaking websites.