[oneweekwonder]

But cors[0] headers can mitigate some of the risk?

[0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

[amenghra]

You want CSP headers to mitigate XSS risks.

[thefreeman]

Not really. CORS headers are set by the destination of the XHR. In the case of XSS it would be an attacker controlled server used to exfiltrate user cookies, etc.