CORS is about safely allowing two cooperating, different origins to communicate. In this case, Facebook and the host are cooperating.