The browser uses SOP (same-origin policy) to protect the user. SOP/CORS does not to protect the services. CORS is a way of the original domain informing the browser that other domains are trusted.
By default, browsers block JS requests made from a.com to b.com.
b.com can publish CORS headers to notify browsers that a.com is trusted (e.g. facebook.com can publish that their messenger.com domain is trusted)
Good browsers block cross origin scripts to protect users. If b.com publishes CORS with certain trusted domains, the browser allows those domains to access services at b.com. If the browser didn't block these for the user, a user could access innocent-looking-malicious-site.com which could access facebook.com services on the user's behalf and get access to secure cookies and other information.
Loose Relation to XSS
If a legitimate site has been compromised by an XSS attack, the SOP/CORS/browser combination can protect the user if the legitimate site's domain name isn't published in the CORS header.
SOP/CORS can't protect a site from being compromised by XSS, but it can help the user if they access an XSS compromised site.
Added clarifications pointed out by user jub0bs