CSRF tricks an authenticated user into unknowingly submitting a request (fund transfer, password change) to a trusted site.
The attacker hosts a page that fires the request; the browser automatically attaches the victim's cookies.
Mitigation
Synchroniser CSRF tokens, SameSite=Strict cookies, Origin/Referer validation.