You have to remember the javascript is running within the browser -- the browser itself uses multiple threads and (especially in Chrome) multiple processes.
When you create an XHR request (it's an abstraction) the browser is going to open up a local TCP port itself within its permission levels, and run this task likely on its own thread.
This is why JS works so well for IO -- you can think of letting the browser open up a local tcp port and then communicating with the remote web server as similar to connecting and reading from a database with node.js.
The browser can open up multiple tcp connections, they can be shared underneath the hood, but then, when the responses return it can only process a response from one of these XHR requests (the abstraction talking to the browser) at a time within the JS event loop.
Although, workers (clustering and child.fork() in node) etc are also available in modern JS.