The only useful thing about your routine is cleaning the cookies. It's not useful in itself, it is just that, this way, you delete your login session and so a new login (which requires inputting a secret like a password) is required to interact with the shopping site. A better alternative (in terms of your user experience and security) would be logging out from the site.
It goes untold that the CCs information is not stored in your computer but in the servers managed by the shopping site company. So that cannot be stolen from your browser and without a valid login session, no sane shopping site would allow sensible operations. If the shopping site is vulnerable, you've already lost.
If you saved your CCs in the browser (is this possible? I hope it's not just form auto-filling) they cannot be stolen from third parties (see below).
Note also that any attack that can be performed on a login session from another tab, can also be performed later when the victim site's tab had already been closed. Granted that the login session persists, client-side, after the closing (which is not the case if you log out or clear the cookies when done or wait enough time).
This is because browsing happens at discrete times and the sites cannot actually tell if the user is still viewing their page. From the shopping site's POV, unless you perform an action, you have already closed its tab, even if you are still reading an item's description. So a malicious request doesn't have to be performed while the shopping site is open, it can be performed any time later (as long as your browser can still identify itself to the site).
Web pages can't access each information other unless coming from the same origin (e.g. same domain) or explicit permission has been granted. Bug in the browser's behavior is possible but should be rare when it comes to enforcing policies. Keep your browser updated.
Browsers can have serious vulnerabilities labeled "zero-days", that would allow a website to take over your browser. Depending on the specific attack, complete access to saved login sessions and password is entirely possible. Escalations that took over the entire machine have been demonstrated and used many times. It suffices to visit a website and it would be totally invisible. The good news is that this zero-click zero-days are worth "a lot" (though in the Apple context, they are losing their value due to the great number of them) and are generally used only against very sensitive targets (think of politicians, national security issues, industry espionage). Committing a felony is not a reason good enough to waste a zero-day on someone, let alone stealing your CC.
Depending on how paranoid you are, you can:
Visit the shopping site normally. You trust your browser to not be vulnerable to basic policy bypass (a rare event) and to zero-days (a quite probable event but not worth on you at all); You trust the site to not be vulnerable to certain attacks.
Visit the shopping site and log out when done. You only trust your browser to not be vulnerable to zero-days. Even if the site is vulnerable or the browser policies are broken, without a login session the attacker could not target "you". Still, if you save your passwords they could be stolen by a zero-day (very very rare event).
Visit the shopping site with a different browser and log out when done. You trust another (possibly hardened at the cost of UX) browser to not have zero-days vulnerabilities or not to have, in your whole software park, zero-days big enough to allow a rogue browser to take over the other applications. If you use a different browser, the attacker would need to escape any sandbox the OS put around the browser (if any).
Avoid suspicious sites. You avoid the problem in the first place. It's impossible to avoid them all, especially because most popups auto opens. But serious attacks are targeted towards you. The usual popups on streaming sites just try to fool you, so don't worry about them, but if you find a sticker on your (and only your) door which read "visit whatever.com for free stuff!" it's best not to do so.
Visit the shop in person. You only trust your person to not be vulnerable to the here-is-a-knife-gimme-yer-wallet attack.
I personally go with point 2 and never save the passwords of sensitive sites in the browser (use a password manager if needed).
