In a world without CORS, browsers would allow unrestricted access to resources across different domains.

 In a world without CORS, browsers would allow unrestricted access to resources across different domains. If a user visits another site while logged into services like banking or email, that site’s scripts could automatically send requests with the user’s credentials and read sensitive data such as account balances or personal information. Data could be extracted without the user’s intent, creating a highly dangerous security environment.