Functionality was delivered as part of Tridion Sites 10
Below is the history of changes to this idea's status. Return to the idea.
Indeed Tridion Sites CoreService.REST does not have out-of-the-box CORS support for js clients
However, you can run web application under some domain as REST API
Let's collect some more votes