The browser uses CORS to protect the user. It does not to protect the services.
By default, browsers block JS requests made from a.com to b.com.
b.com can publish CORS headers to notify browsers that a.com is trusted (e.g. facebook.com can publish that their messenger.com domain is trusted)
Good browsers block cross origin scripts to protect users. If b.com publishes CORS with certain trusted domains, the browser allows those domains to access services at b.com. If the browser didn't block these for the user, a user could access innocent-looking-malicious-site.com which could access facebook.com services on the user's behalf and get access to secure cookies and other information.
Loose Relation to XSS
If a legitimate site has been compromised by an XSS attack, the CORS/browser combination can protect the user if the legitimate site's domain name isn't published in the CORS header.
CORS can't protect a site from being compromised by XSS, but it can help the user if they access an XSS compromised site.