If you experience that the Google Cloud Cors is not working even after you did “gsutil cors set cors.json gs://your-bucket/”, it may be because you are using the wrong root domain, only one of the domains will have the headers enabled on the request, so
storage.googleapis.com/your-bucket ⬅ will not have headers
your-bucket.storage.googleapis.com ⬅ will have cors headers
Something very easy to overlook and Google by default links to the storage.googleapis.com/your-bucket from the interface, so if you copied that and thought it work.
They do say it here, but that is the only place, which I think is not enough