Is CSRF token vulnerable if CORS is enabled?

Question

Let's analyze the following scenario:

• User authenticates with session cookie
• I have CORS enabled (like Access-Control-Allow-Origin: * - header)
• I use CSRF Token to prevent CSRF attacks and I include it in HTML document's body

Is it possible to perform CSRF attack like this?: (Attack from domain: attack.com)

1. In atack.dom/index.html is written script that executes GET mydomain.com via e.g. window.fetch.
2. This script extracts CSRF Token from fetched mydomain.com/index.html
3. It performs then the real CSRF attack as it already has valid CSRF Token so it does attach this token to <form> and submit this prepared <form>

Is it possible? Is enabling CORS possibly making my wesbite vulnerable to CSRF attack despite the fact I'm using CSRF Token protection?