Which statement best contrasts CSRF and XSS?

• A. CSRF exploits user session to perform actions; XSS injects scripts into content to execute in user’s browser.
• B. CSRF and XSS are the same.
• C. CSRF is about cross-site scripting; XSS is about cross-site request forgery.
• D. CSRF is about phishing; XSS is about password cracking.

Answer: (A)

The essential distinction is how each attack operates and what is compromised. CSRF exploits the victim’s existing session with a site to perform actions on that site without the user explicitly initiating those actions, typically by inducing a crafted request that the site will accept because the user is authenticated. XSS injects malicious scripts into web content that the site serves, causing the browser to execute code in the context of that site, which can read data, steal credentials, or perform actions on behalf of the user. This matches the statement that CSRF uses the user session to perform actions, while XSS injects scripts into content to execute in the user’s browser. The other options mix up the concepts or misstate what each vulnerability does, such as claiming they’re the same, swapping the terms, or tying them to phishing or password cracking.