First of all, I'm quite new to web security so this might be a dumb question. Also English is not my native language so there might be some errors.
I understand that by having a csrf token as a hidden parameter in a form or HTTP header, an attacker cannot use something like an image tag to perform an action on the user's behalf. I also understand that if you have an XSS on the website, you can steal the csrf token and perform any action.
What I don't understand however is what prevent an attacker to his own domain, like
There should be a mechanism that I don't understand here because it makes no sense for me right now. What don't I understand?