How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]

How can the CSRF happen if browsers do not allow cross-origin requests by default?
Here is a brief CSRF overview, which is relevant for the question. CSRF (i.e. cross-site request forgery) is a type of attack. For the attack to happen, the… Continue reading How can the CSRF happen if browsers do not allow cross-origin requests by default? [duplicate]