“The fundamental security problem underlying cross-site attacks is that the web in its open nature does not allow web application servers to easily distinguish between requests originating from its own application or originating from a malicious (cross-site) application, potentially opened in a different browser tab.”
The browser now tells the server where each request came from. A bank can refuse anything that came from another site. That kills a whole class of CSRF and cross-site leak attacks with a few lines of server code. It took the web 25 years to add a header saying who’s asking.