The `ResourceIsolationRequestCycleListener` fails to properly protect applications against cross-site request forgery due to unsafe allowances in the `FetchMetadataResourceIsolationPolicy`. First, it allows all simple top-level navigations where `Sec-Fetch-Mode` is `navigate` and `Sec-Fetch-Dest` is neither `object` nor `embed`, regardless of the `Sec-Fetch-Site` value. This allows an attacker to trigger component listeners, such as `Link.onClick()`, through cross-site GET navigations. Second, it unconditionally allows requests with `Sec-Fetch-Site` set to `same-site`, enabling sibling origins (different subdomains or ports) to invoke listeners via any method, including POST form submits.