IE10 and Cross-origin resource sharing (CORS) issues

I was under the impression that Internet Explorer 10 supported CORS, but now I'm not sure.

We have a JS/HTML5 App that uses multiple domains, and reads image data. For this to work we have had to set response headers on the server that's serving the images:

access-control-allow-origin:*
access-control-allow-credentials:true

This is working fine for all new browsers, apart from IE10 which is throwing security errors when we try to read the data.

SCRIPT5022:SecurityError

I've tried various tweaks, including setting the image.crossOrigin = "Anonymous"; property, but just can't get it to work.

Is there something more that needs to be done for IE10 to treat these cross domain images as not tainting?

PS. Interestingly my IE10 will not run this script: test-cors.org , although this is generating a syntax error, not a security error.