The problem is the following and is a security issue:
If you really want to use it, in firefox, you can set privacy.file_unique_origin to false
You can’t run ajax from a file:// protocol, you’ll always end up with CORS errors.
You must use a web server.