Thanks a lot for this beautiful example, so by going with your example if google.com is not whitelisted in the play.google.com using cors then any request from google.com to play.google.com will be failed and the server that is play.google.com don't send the data.
Is my understanding correct? if wrong please correct me