Why does xss attack exist?

Question

CSRF

if we go to the attacker's site, then a request is sent to bank.com
with our data, which is an xss attack,
but this cannot be, because there is such a thing as sop. same-origin policy
and logically because of sop there are no xss attacks, help me figure it out