I'm not able to understand how can the malicious domain access facebook account from a different tab and how does SOP protect against this?
Tabs are not isolating entities. That is, cookies are shared between every window a browser has open, including all tabs on those windows. The only exception to this are private/incognito windows. Therefore, if a tab open on
evil.com makes an AJAX request to
facebook.com, your auth cookies from
facebook.com will be sent along with the request. The Same Origin Policy prevents
evil.com from reading the response from
facebook.com as the domains do not match.
The malicious domain is free to send a GET/POST request to facebook.com, and the browser will attach a cookie for facebook if available. But then wouldn't the problem be due to facebook's server side protection (CSRF scenario)? How does SOP help in this case?
CSRF protection should only prevent unsafe methods - actions with side effects. That is:
the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested.
So if the site has been implemented with respect to this convention, CSRF protection should only be active for POSTs (technically PUT and DELETE too, but these are rarely used).
As said, the SOP does not stop requests from being made, only the responses from being read. Even with the SOP,
evil.com could make a POST request to
facebook.com's "Delete Account" page, and if the user was logged in to Facebook, cookies would be sent.
However, if Facebook have implemented CSRF protection using tokens on the Delete Account page then a CSRF token will need to be submitted with this POST.
evil.com can make a GET request to
facebook.com to the page containing the CSRF token. However, the SOP prevents the response from being read. The SOP protects Facebook's CSRF tokens and prevents CSRF attacks from happening when protected by tokens.