product · inferred from evidence
Cross-Origin-Opener-Policy
A response header that controls whether a page can open cross-origin popups.
- PayPal button click opens login overlay plus an empty popup window
The root cause is the `Cross-Origin-Opener-Policy` response header: if your site sends `same-origin`, the PayPal SDK detects it cant open popups and falls back to an iframe overlay, but the popup opens anyway, empty, on top of the overlay.