I am pretty much new to web development.

And recently I came across a term called CORS (Cross Origin Resource Sharing).

What I understand is that:
Suppose I visit a site called www.example.com in my browser. The served page has a JavaScript embedded in it. If the embedded JavaScript is sending a request to another site which is in a different domain (lets say: abc.com), is this request blocked by the browser?
OR the request is sent to abc.com; but abc.com server sends a ‘NO’ to the browser; then the browser says to the user that the request to abc.com is not allowed.

I read through several answers and baffled which of the above two statement is correct.

If the second statement is correct, then browser has nothing to do with CORS; because it still sends the cross origin request to the other domain web server. So CORS responsibility lies 100% with the web server.

And also I understand that backend servers identifies the domain from origin http header field. So CORS comes into picture whenever if there are frontend tools to communicate with the server (like: browsers) where headers are populated by the tools.

If the communication happens via only API calls (say: using a programming language library), CORS risk is not at all there.
Say for example: If I use CURL, the origin http header field is not populated; So the server can not identify from where the request comes from. And hence CORS is nowhere in this communication. Am I correct here?