Cross-Site Request Forgery (CSRF) is when an attacker takes advantage of a logged-in user's authenticated state to execute malicious application requests and change the user's app in harmful ways. Because the attacker can't see the result of any attack, it's usually less about exfiltrating information and more about exploiting the app's capabilities (for example, making the user of a mobile payment system send money to the wrong person). There's often a strong social engineering aspect involved: phishing and other techniques are used to get a user to click on the link that will kick off a malicious request and act as the CSRF attack vector.
CSRF is often possible because authentication credentials or cookies meant for one part of an application mistakenly allow access to another. An example would be that while...