As I have read about CSRF tokens, the server usually embeds the CSRF token in the form on a hidden tag. In that way, when submitting the form as a POST request, the CSRF token can be sent and received on the server side for authentication.
So, my idea is that a malicious script might request for the same form (with the CSRF token embedded) and use the CSRF token to perform an attack.
How can we protect the application if the case above is possible? Am I missing anything? Thanks in advance guys!
EDIT / UPDATE:
Ok let's say you have a banking website open on your browser with a form with CSRF token, then you open some malicious site in another tab. The malicious site loads and performs a request to the server to get the form (with the embedded CSRF token) then parses it and use the CSRF token to perform an attack. Is that possible?