Is this something restricted by cross-origin policy or not?
No. The page is the origin, not the script.
The page is on www.foo.com. The script is loaded from www.example.com. XHR requests can be made to www.foo.com but not www.example.com.
www.foo.com
www.example.com