Stack Exchange network consists of 183 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Q&A for work
Connect and share knowledge within a single location that is structured and easy to search.
While the whole method of XSS and CSRF attacks are totally different, the main difference is that:
XSS - Runs a Script on the brwoser
CSRF - Sends a (HTTP) request from the browser.
Is correct (a Yes or No answer will suffice)?
Exactly. The XSS (Cross Site Scripting) try to execute in some way a script on victim's browser. It can be reflected, stored, etc.
The CSRF (Cross Site Request Forgery) try to use a victim's already logged cookie/session to perform any action on a web.