I have an error reporting beacon I created using Google Apps script and it is published to run as myself and to be accessible to "anyone, even anonymous," which
I stumbled upon the same issue:
/exec-urls from the browser went fine when running a webpage on localhostI was trying to avoid refactoring my POST JSON-clientcode into JSONP (I was skeptical, since things always worked before).
Luckily, after I did one non-CORS request (fetch() in the browser from a https-domain, using mode: no-cors), the usual CORS-requests worked fine again.
A last explanation might be: every new appscript-deployment needs a bit of time/usage before its configuration actually settled down at server-level.