I understand SOP, 'Same origin policy' is supposed to prevent script code with origin x from accessing data with origin y. Origin is said to be a tuple of protocol, domain and port.
This explains what SOP is and why it is important, but not so much how it helps in preventing XSS.
An attacker could craft a malicios link
http://www.store.com/sale/products?id=<script>script stuff..</script> and making the user click on it. Vulnerable site would reflect the code back to clients browser. If I'm understanding this right, SOP would prevent the js code from accessing data in the clients browser that belongs to another origin (say, facebook.com) and stealing a session cookie.
Now, If the malicios code was coming from facebook.com, as it would in a stored xss attack, the SOP would apply?
TL;DR : I guess my question is how does the 'Same origin policy' prevent XSS attacks, and if there are types of xss it doesn't prevent. Also how does SOP translate to cookie security, specifically, the case when an attacker steals users session cookies and uses it to perform actions on users behalf.