According to @aaronpk, it was first called CORS in 2009, but wasn't a W3C final spec until 2014. The first draft of OAuth 2 was in 2010. 
https://caniuse.com/#feat=cors says the only browser that fully supported CORS in 2010 was @firefox. @googlechrome had partial support. #oauth2
            
                              
        https://caniuse.com/#feat=cors says the only browser that fully supported CORS in 2010 was @firefox. @googlechrome had partial support. #oauth2
