Acme Checkout
A third-party agent app rendered inside the host.
Pay $42.00
Try declared origin (api.stripe.com)
Inject attack (exfiltrate)
ready.