How does a xsrf token cookie protect against csrf?

Question

Wouldn't a malicious site be able to read the cookie using xss cookie stealing and put it in the header of an ajax request?

Answer 1

Of course, if the site is vulnerable to xss, it's also vulnerable to csrf, but that's the smaller issue then.

If there is no xss though, the attacker has no way to read the token due to the same origin policy.