The Checkout Exploit
Google Chrome supports a controversial API known as “Payment Handlers.” This API allows third-party web applications (like digital wallets or obscure payment processors) to explicitly request to manage your checkout experience. Instead of a standard credit card form, a website can spawn a custom interface intercepting your payment flow. While designed for modern e-commerce, it is a significant security risk. Malicious websites can exploit this API to present fraudulent payment overlays that perfectly mimic legitimate banks or services, tricking you into authorizing fraudulent transactions. You must paralyze this API.
How to Block Payment Handlers Globally
You can permanently sever the browser’s ability to interface with third-party payment gateways via Chrome’s Site Settings.
- Open the Google Chrome desktop browser.
- Click the three vertical dots (⋮) in the top right corner and select Settings.
- In the left-hand sidebar, click on Privacy and security.
- In the main window, click on Site settings.
- Scroll down to the “Permissions” heading and click to expand Additional permissions.
- Click on Payment handlers.
- Under the “Default behavior” heading, select the radio button for “Don’t allow sites to install payment handlers.”
Absolute Checkout Security
The change takes effect instantly. Google Chrome will completely sever its internal support for the Payment Request API. The browser is now permanently blind to any third-party checkout software attempting to hook into your session. If a website attempts to execute a script to spawn a custom payment handler, the API call will instantly auto-reject in the background. You will still be able to manually type your credit card into standard web forms or use native Chrome autofill, but external scripts are strictly barred from intercepting the transaction.