how can state parameter prevent CSRF attacks

Question

In the OAuth2 authorization grant flow, the client application passes a state parameter to the authorize endpoint. When the state parameter is visible in the browser url, how does state parameter prevent CSRF attacks.