That will have to be addressed by the Chrome permissions dialog ... Agreed though, I think it would be wise to make the user type-in their CVC or something before transmitting the payment info.