Which of the following conditions must be given to allow a tester to exploit a Cross-Site Request Forgery (CSRF) vulnerable web application?

CSRF is a browser-agnostic vulnerability that does not depend on the specific version of Internet Explorer, as it exploits how any browser automatically attaches session cookies to cross-origin requests.

The HttpOnly flag prevents JavaScript from reading cookies to mitigate XSS-based session theft, but it does not prevent the browser from automatically sending cookies with cross-origin requests, so it does not address CSRF.

CSRF exploitability is not tied to Firefox version; it affects all browsers that automatically include credentials with cross-origin requests regardless of vendor or version.

Anti-CSRF tokens are the primary defense against CSRF because they require the attacker to know a secret value tied to the user's session, which a forged cross-origin request cannot obtain due to the Same-Origin Policy. Without random tokens, the server has no mechanism to verify that a state-changing request was intentionally submitted by the authenticated user. All major CSRF defenses - synchronizer tokens, double-submit cookies, SameSite cookies - exist specifically to compensate for the absence of this unpredictability.