A patch for this issue. The approach is to vary the cache-id to distinguish between sites. This causes the favicon paths to mirror the hostnames they'll be retrieved from (e.g. https://example.com vs https://www.example.com) and avoid CORS errors on any manifest files.
blairlearn → created an issue.