The same-origin policy prevents JavaScript from making requests across domain boundaries, and has spawned various hacks for making cross-domain requests.
CORS introduced a standard mechanism that can be used by all browsers for implementing cross-domain requests. The spec defines a set of headers that allow the browser and server to communicate about which requests are (and are not) allowed.