The same-origin policy is a browser security feature that restricts scripts from one origin from accessing resources from a different origin. CORS is an exception to this policy, allowing controlled access to cross-origin resources.