What is the primary security purpose of the CORS (Cross-Origin Resource Sharing) mechanism enforced by web browsers?

CORS is a browser-enforced security mechanism that controls whether a web page loaded from one origin (combination of scheme, domain, and port) is allowed to make requests to a server on a different origin, and whether that server's response can actually be read by the requesting page's JavaScript. Servers explicitly opt in to allowing specific cross-origin requests via response headers (such as Access-Control-Allow-Origin), preventing malicious sites from silently reading sensitive data from other origins on a user's behalf. CORS has nothing to do with encrypting traffic (that's the role of TLS/HTTPS), compressing payloads, caching responses, or authenticating user credentials — those are separate, unrelated mechanisms.