Index: src/wp-includes/rest-api.php
===================================================================
--- src/wp-includes/rest-api.php	(revision 43966)
+++ src/wp-includes/rest-api.php	(working copy)
@@ -527,7 +527,11 @@
 
 /**
  * Sends Cross-Origin Resource Sharing headers with API requests.
- *
+ * 
+ * Note: Any incoming Origin URL is verified against a safe-list of Origins
+ * using the Allowed Origin API, before these headers are sent.
+ * {@see 'allowed_http_origins'} filter on how to add an Origin to this list 
+ * 
  * @since 4.4.0
  *
  * @param mixed $value Response data.
@@ -535,8 +539,8 @@
  */
 function rest_send_cors_headers( $value ) {
 	$origin = get_http_origin();
-
-	if ( $origin ) {
+	$allowed_origins = get_allowed_http_origins();
+	if ( $origin && in_array( $origin, $allowed_origins ) ) {
 		// Requests from file:// and data: URLs send "Origin: null"
 		if ( 'null' !== $origin ) {
 			$origin = esc_url_raw( $origin );