If you have XSS attack vector on your site, the attacker can do almost anything including cookie access(for all cookies that aren't HttpOnly). Also CSRF protection doesn't protect against clickjacking attacks where the page is iframed set transparent and user is encouraged to click in a specific location(punch the monkey in the face) on the attackers page. Easiest solution is to use javascript to detect if your page is iframed and bust out of it.