Re: [w3c/payment-request] Disable Payment Request API in CSP/iframe sandbox (#698)

Real world example: [dropbox.com/enterprise](https://www.dropbox.com/enterprise) runs with CMS which they made isolation with main [dropbox.com/](https://www.dropbox.com/) using CSP sandbox. XSS in CMS theoretically has no impact on main [dropbox.com/](https://www.dropbox.com/) but in this case, attacker can ask for payment :) 
CC: @devd

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-request/issues/698#issuecomment-385191722