Comment by yaur

It’s not that hard to understand… in the cors threat model an attacker gets one your users to take an action on your site by visiting their site.