The supported way to call the Place Autocomplete API from a web app is using the Places library:
That way it doesn’t matter that the responses lack the Access-Control-Allow-Origin header.
Using the Maps JavaScript API that way—by way of a script element to load the library, and then using the google.maps.Map and other google.maps.* methods—is the only supported way. Google intentionally does not allow doing it by way of requests sent with XHR or the Fetch API.