1) User is logged in bank.com in one tab, where everything is secured by CSRF tokens. Then he opens evil.com in another tab.
QUESTION - why the last step will fail and will it always fail?
As far as I understand, bank.com will actually respond to this request and render all the html just fine, but on the client side the browser will decide that content coming from another domain should not be accessible, therefore it fails.
Is it correct? Can this be fooled?