cant a CSRF token be stolen using iframe?

Question

from what I understand a common approach to storing a CSRF token would be:

1. the client retrieves from the server a CSRF token
2. the token is stored in an input element inside the form like this:

<form>
<input type="hidden" name="token" value="abc123supersecrettoken"> 
</form>

my question is, would an attack like this be possible, and if so, how can a site be protected:

1. user logins into facebook.com
2. user goes to evil.com, the site has he following iframe:

<iframe src="https://www.facebook.com/changeUserPasswordForm"></iframe>

3. with some basic DOM manipulation on the iframe, the CSRF token could be accessed by the attacker

Answer 1

would an attack like this be possible

This would not be possible. The Same Origin Policy prevents cross-origin reading. This applies also to an iframe from a different domain which is embedded in the current page.