Best way to solve the CORS problem is using the proxy method.
Original URL: http://services.odata.org/V3/OData/OData.svc
Proxy URL: proxy/http/services.odata.org/V3/OData/OData.svc
You can check others solution in this blog: Solving "Same Origin Policy" Issue in different ways
PS: You shouldn't use new XMLHttpRequest().
Instead, you should use the available jQuery methods in UI5. You can check 2 examples below.
jQuery.sap.sjax(): OpenUI5 SDK - Demo Kit
jQuery.ajax(): http://api.jquery.com/jquery.ajax/