Re: [w3c/browser-payment-api] The origin restrictions in the PaymentRequest are not nearly strong enough (#332)

The point is, it allows B to embed an A iframe and try to manipulate it in various ways (postMessage, URL structure, etc) to try to get it to trigger a payment request.  If the inner iframe is written defensively enough this may be ok, but if it's not, you end up with a problem.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/332#issuecomment-264464630